MITRE ATT&CK is a freely available knowledge base of the tactics and techniques attackers use, based on real-world observations. It gives defenders a shared language for how attacks actually work, from initial access to impact. Used well, it helps organisations understand attacker behaviour, test their defences against it, and find the gaps.
What MITRE ATT&CK is
MITRE ATT&CK is a large, freely available knowledge base that documents how attackers actually behave. Rather than describing vulnerabilities or tools, it catalogues the tactics and techniques that real attackers use, drawn from observations of actual attacks. It has become one of the most widely used references in security, because it captures something uniquely useful: not just what could go wrong, but how attackers really operate.
The name stands for Adversarial Tactics, Techniques, and Common Knowledge. The value is in that last phrase, common knowledge. ATT&CK turns scattered understanding of attacker behaviour into a shared, structured reference that defenders across the industry can use and speak in.
How it is structured
ATT&CK is organised around two main levels. Tactics are the attacker’s goals, the why of each step: gaining initial access, escalating privileges, moving laterally, exfiltrating data, and so on. Techniques are the how, the specific methods attackers use to achieve each tactic. Under techniques sit real-world procedures, the concrete ways particular attackers have carried them out.
This structure mirrors how attacks actually unfold, as a sequence of goals achieved through specific methods. Reading across the tactics, from initial access through to impact, traces the arc of an intrusion. That is what makes ATT&CK so practical: it maps to reality rather than to an abstract model.
Why a shared language matters
One of ATT&CK’s biggest contributions is simply giving everyone the same vocabulary. Before a common framework, different teams and vendors described attacker behaviour in different, inconsistent ways, which made it hard to communicate, compare or build on each other’s work. ATT&CK provides a shared language, so that when one team refers to a particular technique, everyone knows precisely what they mean.
That shared language pays off across the industry. Threat intelligence can describe attacker behaviour consistently, tools can map their coverage to the same reference, and defenders can compare their defences against a common standard. Communication that used to be fuzzy becomes precise.
How defenders use it
Defenders put ATT&CK to work in several ways. They map their existing defences against it, asking which techniques they can detect or prevent and, more importantly, which they cannot, revealing the gaps. They use it for threat modelling, understanding which techniques are most relevant to their environment and the attackers likely to target them. And they use it to guide improvement, prioritising defences against the techniques that matter most.
The common thread is that ATT&CK turns the vague goal of being secure into a concrete, testable question: can we handle the specific ways attackers actually behave. That question is far more actionable than a general sense of security posture.
How it connects to testing and validation
ATT&CK is especially powerful when connected to testing. Because it describes the real techniques attackers use, it provides a natural basis for testing whether your defences hold against those techniques. Rather than testing abstractly, you can validate your defences against the specific behaviours attackers employ, technique by technique, and see which ones you catch and which slip through.
This is where a framework becomes practice. Mapping your defences to ATT&CK tells you what you think you cover. Testing against those techniques proves what you actually cover. The gap between the two is exactly what you need to know, and closing it is how you improve against real attacker behaviour rather than assumptions.
Getting practical value from ATT&CK
For an organisation, the practical path is to start with the tactics and techniques most relevant to your environment and the attackers likely to target you, rather than trying to address the entire framework at once. Map your current defences against those, identify the gaps, validate your assumptions through testing, and prioritise improvements where they matter most. Treated this way, ATT&CK is not an academic reference but a practical tool for continuously understanding and improving your defences against how attackers actually operate.
To test whether your defences hold against the techniques attackers really use, explore our continuous service validation capability, or read how attack surface management reduces the exposure attackers exploit in the first place.
For the framework itself, see the official MITRE ATT&CK site.
Frequently asked questions
What is MITRE ATT&CK?
MITRE ATT&CK is a freely available knowledge base documenting the tactics and techniques attackers use, based on real-world observations. It gives defenders a shared, structured reference for how attacks actually work, from initial access to impact.
How is ATT&CK structured?
Around tactics, the attacker’s goals such as initial access or privilege escalation, and techniques, the specific methods used to achieve them, with real-world procedures beneath. This mirrors how attacks unfold as a sequence of goals achieved through specific methods.
Why is ATT&CK useful?
It gives the industry a shared language for attacker behaviour, so teams, tools and threat intelligence describe attacks consistently. Defenders use it to map their defences, find gaps, model threats, and prioritise improvements against how attackers really operate.
How does ATT&CK relate to testing?
Because it describes real attacker techniques, it provides a basis for testing whether your defences hold against those specific behaviours. Mapping defences to ATT&CK shows what you think you cover; testing against the techniques proves what you actually cover.
