What is MITRE ATT&CK Framework: How to Use It

MITRE ATT&CK began as an internal research project called the Fort Meade Experiment in 2013. Two years later it went public as a free knowledge base, and it’s since become the closest thing cybersecurity has to a shared language for describing what attackers actually do.

What is the MITRE ATT&CK framework?

The MITRE ATT&CK framework is a curated, publicly available knowledge base cataloging real-world adversary tactics and techniques, built from documented incidents rather than theoretical scenarios. Security teams use it as a common vocabulary for detection engineering, threat intelligence, and incident response.

Every entry maps to observed behavior from actual threat groups, not hypothetical attack paths. That distinction matters: when an analyst references technique T1566 for phishing, everyone from the SOC to the board understands exactly what that means, without translation. MITRE maintains and updates the framework continuously through government funding and a global contributor community.

Tactics, techniques, and sub-techniques: how the matrix is structured

MITRE ATT&CK tactics describe the adversary’s goal, the why behind an action. Techniques describe the how, the specific method used to achieve that goal. Sub-techniques break techniques into more precise variants, giving defenders finer-grained detection targets.

The current Enterprise matrix contains 15 tactics, 222 techniques, and 475 sub-techniques, tracking 174 documented threat groups. Take phishing as an example: it’s one technique, T1566, but splits into sub-techniques like spearphishing attachment, spearphishing link, and spearphishing via service, each requiring a different detection approach even though they share the same parent goal.

Enterprise, Mobile, and ICS: three matrices for three environments

MITRE maintains three separate matrices because attacker behavior differs fundamentally by environment: Enterprise covers Windows, macOS, Linux, cloud, and network infrastructure; Mobile covers Android and iOS; ICS covers industrial control systems and physical process manipulation.

Matrix	Tactics	Techniques	Sub-Techniques
Enterprise	15	222	475
Mobile	12	77	47
ICS	12	79	18

ICS techniques rarely overlap with Enterprise ones, since manipulating a PLC’s ladder logic or suppressing a safety alarm has no equivalent in a standard IT breach. By the time an attacker touches operational technology, they’ve typically spent weeks or months operating inside the Enterprise matrix first, which is exactly why most organizations should start there.

What is threat modeling in cyber security, and how does ATT&CK fit in?

Threat modeling in cyber security is the structured practice of identifying, prioritizing, and planning defenses against the specific threats an organization actually faces, rather than defending against every theoretical risk equally. ATT&CK supplies the vocabulary and documented technique library that threat modeling exercises draw from.

Where a framework like STRIDE tells you what categories of threat exist, ATT&CK tells you the specific, real-world methods attackers use within those categories. A mature threat modeling program pulls documented adversary behavior from ATT&CK, maps it against the organization’s actual assets and exposure, and produces a prioritized list of what to defend against first. This is where our own cyber security risk assessment work with clients typically starts, since a risk assessment without a documented technique library behind it tends to stay abstract.

STRIDE, PASTA, and Cyber Kill Chain: how the frameworks compare

STRIDE, developed by Microsoft, classifies threats into six categories, useful for identifying which threats exist. PASTA is a seven-stage, risk-centric methodology tying threats directly to business impact. The Cyber Kill Chain describes attacks as seven sequential stages but covers only what ATT&CK calls Enterprise, with no equivalent for Mobile or ICS environments.

Framework	Focus	Strength
STRIDE	Threat categorization	Fast, structured entry point
PASTA	Business risk	Ties threats to impact
Cyber Kill Chain	Attack sequence	Simple, linear narrative
ATT&CK	Documented behavior	Depth, real-world grounding

These aren’t competing choices, they solve different problems. Many mature programs use STRIDE or PASTA during design-phase threat modeling, then reference ATT&CK for the specific, documented techniques a detection engineer actually needs to build rules against.

Using the ATT&CK Navigator to visualize your own detection coverage

The ATT&CK Navigator is a free, interactive web tool that turns the framework into a visual heatmap, letting you mark which techniques your current tools detect, partially detect, or miss entirely across the full matrix.

Building an honest Navigator map, not an aspirational one, is the single most useful first exercise for any security team new to ATT&CK. Color each technique based on actual, tested detection capability, not what a vendor’s marketing page claims the tool covers. This exercise routinely surfaces gaps teams didn’t know existed, particularly around lateral movement and credential access techniques that don’t trigger traditional signature-based alerts.

A practical workflow: mapping alerts to ATT&CK IDs and running Atomic tests

Tag every alert your SOC generates with its corresponding ATT&CK technique ID, then use Atomic Red Team, a free library of small, safe tests mapped to specific techniques, to verify your tools actually catch what they claim to detect.

This workflow closes the gap between believing you’re covered and confirming it. Run an Atomic test for a specific technique, check whether your detection stack actually fired an alert, and mark the Navigator honestly based on the result. Teams already running EDR threat hunting programs get the most immediate value here, since ATT&CK-tagged alerts give threat hunters a documented starting point instead of hunting blind through raw telemetry.

Beyond IT: MITRE ATLAS and threat modeling for AI systems

MITRE ATLAS extends the same documented-behavior approach to AI and machine learning systems specifically, cataloging 16 tactics, 84 techniques, and 56 sub-techniques covering adversarial attacks against models, training data, and AI pipelines.

As businesses adopt AI tools faster than most security programs can assess them, ATLAS fills a real gap traditional ATT&CK doesn’t cover, prompt injection, model poisoning, and training data manipulation have no clean equivalent in the Enterprise matrix. MITRE explicitly recommends running ATLAS alongside STRIDE and ATT&CK rather than as a replacement, since AI systems still inherit standard infrastructure risk on top of their model-specific exposure.

Why coverage percentage isn’t the goal: prioritizing by actual threat landscape

Chasing 100% technique coverage across 222 Enterprise techniques wastes effort on threats that don’t apply to your actual environment. Effective use of ATT&CK means prioritizing techniques used by threat actors that specifically target your industry and infrastructure, not building detections for every entry in the matrix equally.

A retail business and a defense contractor face genuinely different adversary groups using genuinely different technique sets, and ATT&CK’s own group profiles document exactly which techniques each tracked actor favors. Cross-reference your industry’s most active threat groups against the framework before deciding what to build detection for first, since a manufacturing business spending detection engineering hours on nation-state ICS techniques it will never realistically face is misallocating a scarce resource.

A realistic starting point without a dedicated threat intelligence team

Start with the Navigator, mark your honest current detection coverage across just the Initial Access and Execution tactics, and expand one tactic at a time as capacity allows, rather than attempting full-matrix coverage from day one.

Most smaller security teams don’t need a dedicated threat intelligence function to get real value from ATT&CK, they need a disciplined, incremental habit of tagging alerts with technique IDs and periodically checking that habit against Navigator’s visual map. This single practice, done consistently, tells you more about real detection gaps than most formal maturity assessments ever will.

Conclusion

Pick one tactic, map your real coverage against it this week, and let that single exercise tell you where your next security investment should actually go. Cyber Security Solutions Ltd builds exactly this kind of ATT&CK-mapped detection roadmap for clients at cybersecuritysolutionsltd.com.