Home / Knowledge hub / MITRE ATT&CK
Knowledge hub
MITRE ATT&CK
A public catalogue of the tactics and techniques real attackers use.
What it means
MITRE ATT&CK is a public knowledge base, kept by the non-profit MITRE Corporation, that describes how real attackers behave. It is built from observed incidents and organised into tactics, which are the goals, and techniques, which are the ways of reaching them.
A tactic might be initial access or credential access. A technique under it might be exploiting a public-facing application or phishing. Each has a numbered ID, such as T1190, so people can refer to the same behaviour in the same words.
Why it matters
It gives security and engineering teams a shared language. Instead of saying "they got in somehow", you can say which technique was used, and ask whether you would detect it. That makes reports, drills and conversations with customers more precise.
It also helps spend effort wisely. If your detection covers only a few techniques, you can see the gaps and decide which to close first. It is a reference for the attacker's behaviour, not a score or a certification, and it does not tell you what is likely to hit you.
How it shows up
You meet ATT&CK in threat reports that tag each step with technique IDs, in security tools that map alerts to techniques, and in exercises such as a red team or purple team engagement. It has versions for enterprise networks, mobile and industrial systems, and cloud is covered within the enterprise set.
A common mistake is chasing full coverage. Nobody detects everything, and ticking boxes is not the same as catching real behaviour. Start from the techniques your own threat model says matter, for example abuse of valid accounts and exploitation of web apps, and test whether you would notice them. Pair it with OWASP for application weaknesses.
Questions people ask
MITRE ATT&CK, answered
Is MITRE ATT&CK a framework or a tool?
Neither exactly. It is a knowledge base: a structured, public description of attacker behaviour. Teams build their own processes and tools around it.
It is free to use.
What is the difference between a tactic and a technique?
A tactic is the attacker's goal at a stage, such as persistence or exfiltration. A technique is a specific way of reaching it. Some techniques have sub-techniques with more detail.
Think of the tactic as the why and the technique as the how.
How is ATT&CK different from the OWASP Top 10?
OWASP lists common weaknesses in web applications. ATT&CK describes what attackers do across an intrusion, from first access to impact.
They answer different questions and work well together.
How do we use it as a small team?
Pick a handful of techniques that fit your risks, check whether your logs would show them, and fix the gaps. Use it to read threat reports and to write clearer incident notes.
You do not need to cover all of it.
Does using ATT&CK make us secure?
No. It is a map, not a defence. It helps you think and plan, but the controls still have to be built and tested.
Treat claims of full coverage with caution.
Sources
Where this comes from
Related
Terms that sit next to this one
Threat actor
Whoever might attack you, described by capability and motive.
Red team
A simulated adversary given a goal and left to reach it however they can.
Purple team
Attackers and defenders working together so each test improves detection.
Attack path
A chain of small steps that together take an attacker to something valuable.
Threat model
Asking what is worth taking, who wants it, and how they would try.
How would your web app be used?
Exploitation of public-facing applications is one of the techniques the catalogue lists. We find and prove those weaknesses in your web app and APIs, with the request and response. Ask us to run it on one of your applications.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.