What is MITRE ATT&CK actually for? (not what you think)

MITRE ATT&CK might be the most name-dropped and least understood framework in security. Teams “align to ATT&CK,” vendors wallpaper their marketing with it, and somewhere in the middle the actual point gets lost. Here’s the practitioner version.

What it is

ATT&CK is a catalog of attacker behaviours, built from real-world observations: around 200 techniques (with sub-techniques, 600+) organised under 14 tactics — the attacker’s goals, from Initial Access through Privilege Escalation to Exfiltration and Impact. Each technique has an ID (T1566 is phishing), documented procedures, detection ideas, and a list of real threat groups observed using it.

The crucial design choice: it catalogs behaviour, not tools. Malware changes weekly; the underlying move — dump credentials from memory, abuse scheduled tasks, tunnel over DNS — stays stable for years. That stability is what makes the framework useful.

The three jobs it does brilliantly

1. A shared language. Before ATT&CK, one analyst’s “lateral movement via admin shares” was another’s “SMB abuse” was a vendor’s proprietary name. Now it’s T1021.002 for everyone — your SOC, your red team, government advisories, and your vendor’s detection rules can all point at the same thing. Unglamorous, transformative.

2. Turning threat intel into defensive work. When a CISA advisory says a ransomware crew uses specific techniques, those IDs are a to-do list: for each one — can we prevent it, would we detect it, could we investigate it afterwards? That turns “APT scary” into a gap analysis with receipts. In our own threat graph, crews bridge to their observed ATT&CK techniques precisely so that “who’s hitting my sector” becomes “which behaviours should my controls catch this quarter.”

3. Honest detection coverage. Mapping your actual, tested detection rules against the techniques your actual threats use shows you the real gaps — usually in unfashionable places like Valid Accounts (T1078), which is just attackers logging in with stolen credentials, the most common and least detected technique in the catalog.

The ways teams get it wrong

Treating coverage as a score. “We cover 80% of ATT&CK” is close to meaningless: no organisation needs all techniques covered, techniques differ enormously in relevance, and a flimsy rule that theoretically touches a technique isn’t coverage. A SOC with deep detection on the 30 techniques its real threats use beats a dashboard showing 80% green every time.

Confusing it with a maturity model. ATT&CK describes what attackers do, not what you should buy or in what order. It’s a map, not a route.

Starting from the matrix instead of the threat. The matrix is overwhelming by design — it’s everything anyone does. Start from the crews actually hitting your sector, take their technique lists from advisories, defend those. Ten techniques chosen by evidence beat a hundred chosen by completionism.

Where to start, practically

1. Pick the three threat groups most relevant to your sector (government advisories and any decent tracker will tell you).
2. Pull their techniques from the advisories.
3. For each: prevent? detect? investigate? Three columns, honest answers.
4. Fix the worst row first. Repeat quarterly.

That’s an ATT&CK programme. Everything else is ceremony.

Go deeper

Our ransomware tracker connects live crews to their cited techniques and CVEs, with the government advisory as the receipt. Related reading: the vulnerability alphabet and how ransomware gangs pick victims.