- ClassificationCategoryCybersecurityDomainCybersecurityFramework FamilyMITRE ATT&CK
- Regulatory ContextTypeStandardSectorCross-SectorIndustryCross-Industry
- Region / PublisherRegionGlobalRegion DetailUnited StatesPublisherMITRE Corporation
- VersioningVersionATT&CK v10Effective Date2015Issue Date2013
- AdoptionAdoption ModelOperational SecurityImplementation ComplexityModerate
- Official ReferenceOpen Link in New TabSource
License included / downloadable: Yes
MITRE ATT&CK is publicly available and maintained by MITRE Corporation as an open knowledge base.
Framework text is licensed by its publisher and is included only where stated above.
Overview
MITRE ATT&CK is a cybersecurity knowledge framework that documents adversarial tactics, techniques, and procedures (TTPs) used by threat actors during cyber intrusions. It enables organizations to better understand attacker behaviors and build defenses aligned with real-world threats.
The MITRE Corporation publishes ATT&CK, making it freely available to security professionals, threat intelligence teams, and risk management practitioners across industries. The framework covers intrusion tactics, specific attack techniques, and common knowledge about threat behaviors, supporting areas such as threat detection, incident response, and security control evaluation.
Organizations use MITRE ATT&CK by mapping detected activity and internal security controls to its knowledge base, identifying gaps, and prioritizing improvements. ATT&CK is frequently integrated into SOC operations, threat hunting, and risk assessments, complementing frameworks like NIST Cybersecurity Framework and ISO 27001 in cybersecurity programs.
Why it Matters
MITRE ATT&CK offers a real-world framework that helps organizations understand, prioritize, and strengthen their cyber defense strategies.
Key benefits include:
- Enhance threat detection capabilities
Enable organizations to recognize and respond to attacker techniques based on adversary behavior patterns and real incident data.
- Support incident response effectiveness
Provide a shared language and reference for teams to simplify investigations and improve response decision-making under pressure.
- Strengthen cybersecurity governance
Facilitate risk-based prioritization of controls and investments by mapping defensive measures to documented adversarial techniques.
- Promote continuous security evaluation
Help organizations identify defense gaps and assess coverage against evolving tactics, techniques, and procedures used by real-world threats.
- Increase regulatory and audit readiness
Demonstrate rigorous threat-informed practices for regulators and auditors, supporting compliance with industry cybersecurity requirements.
How it Works
The MITRE ATT&CK framework structures cyber adversary behavior through a complete matrix of tactics and techniques encompassing various stages of an attack. The framework categorizes tactics as specific attacker objectives, while techniques detail the methods used to achieve those goals. This matrix approach provides a common taxonomy for understanding and analyzing real-world threat behaviors across the cybersecurity landscape.
In practice, organizations use ATT&CK to inform security practices by aligning security controls and monitoring mechanisms with documented adversarial techniques. Security teams use ATT&CK to perform threat modeling, assess defensive coverage, and guide incident response activities. By mapping detected activities to specific ATT&CK techniques, organizations can prioritize risk management initiatives and continuously monitor their security posture for evolving threats.
SmartSuite enables operationalization of the MITRE ATT&CK framework by offering libraries of mapped security controls, centralized risk registers, and policy governance tools. Users can document evidence of ATT&CK technique coverage, track compliance status, manage remediation workflows, and generate dashboards to report on threat monitoring and governance effectiveness. This integrated approach supports continuous improvement in cybersecurity compliance and risk management.
Key Elements
- Adversarial Tactic Categories
Organizes the sequence of high-level attacker goals and objectives throughout the lifecycle of a cyber intrusion.
- Technique and Sub-Technique Catalog
Describes the detailed, hierarchical classification of specific actions adversaries employ to achieve their objectives.
- Procedure Mapping Structure
Establishes links between documented threat group behaviors and associated techniques for empirical reference.
- Mitigation and Detection Guidance
Outlines recommended countermeasures and detection methods linked to specific techniques within the matrix.
- Data Source Taxonomy
Specifies types of security logs and data sets relevant for monitoring and detecting each attack technique.
- Knowledge Base Interrelationships
Defines structured associations between tactics, techniques, procedures, mitigations, and detection rules across the framework.
Framework Scope
MITRE ATT&CK is adopted by security operations teams, threat intelligence analysts, and organizations defending enterprise networks and critical information systems. The framework governs detection, monitoring, and incident response activities in on-premises, cloud, and hybrid environments, often implemented when enhancing threat hunting, aligning with security controls, or demonstrating control effectiveness within assurance programs.
Framework Objectives
MITRE ATT&CK provides a knowledge base to understand and counter adversarial tactics within cybersecurity risk management and governance programs.
Enhance detection and analysis of threat actor techniques and behaviors
Improve cybersecurity governance by aligning security controls with real-world threats
Support regulatory compliance and audit readiness through structured adversary mapping
Strengthen risk management by identifying gaps in defense and prioritizing improvements
Enable more effective data protection through proactive threat intelligence
Promote operational resilience by informing incident response and threat hunting activities MITRE ATT&CK maps adversary tactics and techniques to practical detection and response controls and is often used alongside the Lockheed Martin Cyber Kill Chain, MITRE D3FEND,and NIST Cybersecurity Framework. Organizations implement ATT&CK for threat hunting, adversary emulation, SOC maturity and operational security improvements, and to align threat intelligence with STIX/TAXII sharing.
Framework in Context
MITRE ATT&CK maps adversary tactics and techniques to practical detection and response controls and is often used alongside the Lockheed Martin Cyber Kill Chain, MITRE D3FEND, and NIST Cybersecurity Framework. Organizations implement ATT&CK for threat hunting, adversary emulation, SOC maturity and operational security improvements, and to align threat intelligence with STIX/TAXII sharing.
Common Framework Mappings
Organizations map ATT&CK to complementary standards to align threat intelligence, detection and response controls with governance, interoperability, and regulatory compliance across enterprise and cloud environments.
Mapped frameworks include:
CIS Critical Security Controls
ISO/IEC 27001
Lockheed Martin Cyber Kill Chain
MITRE D3FEND
NIST Cybersecurity Framework
NIST SP 800-53
OASIS STIX/TAXII
PCI DSS
How SmartSuite Supports MITRE ATT&CK 10
SmartSuite provides the system for managing controls, evidence, mappings, assessments, and reporting.
Centralize controls, evidence, and audit workflows to stay continuously SOC 2–ready.
ATT&CK Technique Coverage Map
Track coverage by tactic/technique and identify detection and control gaps.
Detection Engineering Backlog
Manage detection workstreams with owners, priorities, and implementation status.
Test Plans and Validation Evidence
Store purple-team results, simulations, and validation proof tied to techniques.
Incident Response Playbooks
Link playbooks and response tasks to ATT&CK behaviors for consistent handling.
Exceptions and Risk Acceptance
Document gaps, compensating controls, approvals, and timelines to close coverage.
Executive Threat Detection Reporting
Report detection maturity and coverage trends by tactic, technique, and team.
Frequently Asked Questions For MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge)
MITRE ATT&CK is used to document and analyze adversary tactics, techniques, and procedures observed in real-world cyber attacks. Organizations use it to inform threat detection, enhance incident response, and evaluate the effectiveness of security controls against known attacker behaviors.
MITRE ATT&CK is not a certifiable standard and is not mandated by regulatory bodies. It is a freely available knowledge framework adopted voluntarily to strengthen cybersecurity practices and improve threat-informed defense initiatives.
The MITRE ATT&CK framework is suitable for security teams, threat intelligence analysts, SOC operators, and compliance professionals across all industry sectors. Its scope covers a comprehensive range of adversary behaviors, tactics, and techniques applicable throughout the cyber attack lifecycle.
Key components of MITRE ATT&CK include a matrix of tactics (attacker goals), techniques (methods to achieve those goals), and procedures (specific implementations observed in the wild). The framework also contains mappings to threat actor profiles and specific incidents, facilitating detailed threat intelligence analysis.
Organizations implement MITRE ATT&CK by mapping internal security controls and monitoring activities to specific ATT&CK techniques. This includes developing detection analytics, documenting coverage, and aligning incident response procedures with the framework to address identified gaps.
MITRE ATT&CK complements other cybersecurity frameworks such as the NIST Cybersecurity Framework and ISO 27001 by providing concrete examples of attacker actions. It is often used alongside these frameworks to inform risk assessments, threat modeling, and control selection.
Effective use of MITRE ATT&CK requires ongoing mapping of new threats, regular review of security control effectiveness, and continuous updating of threat intelligence sources. Organizations should ensure their coverage remains current as attacker tactics and techniques evolve.
SmartSuite supports MITRE ATT&CK by providing mapped security control libraries, centralized risk and threat registers, and policy governance tools. Organizations can collect and document evidence of ATT&CK technique coverage, manage remediation workflows, maintain audit readiness, and generate detailed reports on threat monitoring and compliance status.
Manage controls, risks, evidence, and audits in one platform designed for modern governance, risk, and compliance.