MITRE ATT&CK Framework

Last reviewed: August 26, 2026

The MITRE ATT&CK Framework is a comprehensive knowledge base of adversary tactics and techniques based on real-world observations. It is used by cybersecurity professionals to understand and mitigate cyber threats. The framework categorizes and describes various stages of cyber attacks, providing a structured approach to threat detection and response. As of October 2023, the MITRE ATT&CK Framework is widely adopted by organizations worldwide to enhance their cybersecurity posture.

Overview

The MITRE ATT&CK Framework serves as a globally accessible repository of information on cyber adversary tactics and techniques. It is designed to help organizations improve their cybersecurity defenses by providing detailed insights into the methods used by threat actors. The framework is organized into matrices that cover different domains, such as enterprise, mobile, and industrial control systems. Each matrix includes tactics, which represent the goals of an adversary, and techniques, which are the methods used to achieve those goals. The framework is continually updated to reflect the evolving threat landscape.

History

The MITRE ATT&CK Framework was developed by the MITRE Corporation, a not-for-profit organization that operates federally funded research and development centers in the United States. The framework was first introduced in 2013 as a means to document and share knowledge about cyber adversary behavior. Initially, it focused on post-compromise detection, but it has since expanded to cover the entire attack lifecycle. Over the years, the framework has gained recognition and adoption in the cybersecurity community for its practical utility and comprehensive coverage of adversary techniques.

Scope and Requirements

The MITRE ATT&CK Framework encompasses a wide range of cyber threats and adversary behaviors. It is divided into several matrices, each tailored to specific environments such as enterprise networks, mobile devices, and industrial control systems. The framework includes tactics such as initial access, execution, persistence, privilege escalation, defense evasion, credential access, discovery, [lateral movement], collection, exfiltration, and impact. Each tactic is associated with multiple techniques that describe specific actions adversaries may take to achieve their objectives.

To effectively use the MITRE ATT&CK Framework, organizations need to have a basic understanding of cybersecurity concepts and a commitment to continuous monitoring and improvement of their security posture. The framework can be integrated into existing security operations and incident response processes to enhance threat detection and response capabilities.

Adoption

The MITRE ATT&CK Framework has been widely adopted by organizations across various sectors, including government, finance, healthcare, and technology. Its adoption is driven by its comprehensive coverage of adversary tactics and techniques, as well as its ability to provide actionable insights for threat detection and response. Many cybersecurity vendors have integrated the framework into their products and services, offering solutions that leverage ATT&CK data to improve threat intelligence and security operations.

Organizations use the framework to map their security controls to known adversary techniques, identify gaps in their defenses, and prioritize security investments. The framework is also used for threat hunting, red teaming, and security assessments, providing a common language for communicating about cyber threats and defenses.

Criticism

While the MITRE ATT&CK Framework is widely regarded as a valuable resource, it has faced some criticism. One common critique is that the framework can be overwhelming due to its extensive coverage of tactics and techniques, making it challenging for smaller organizations with limited resources to implement effectively. Additionally, some critics argue that the framework's focus on known techniques may not adequately address emerging threats and novel attack methods.

Another criticism is that the framework does not provide specific guidance on how to implement security controls or mitigate specific techniques, leaving organizations to determine the approach for their unique environments. Despite these criticisms, the MITRE ATT&CK Framework remains a widely respected and utilized tool in the cybersecurity community.