MITRE ATT&CK

MITRE ATT&CK

Published by The MITRE Corporation · ATT&CK v19

A globally accessible knowledge base of adversary tactics and techniques based on real-world observations, used as a foundation for threat models and detection strategies across the private sector, government, and the cybersecurity product and service community.

How it’s structured

• Organized into separate matrices — Enterprise, Mobile, and ICS (Industrial Control Systems)
• The Enterprise matrix currently lists 15 tactics (the adversary's "why"), each broken into techniques and sub-techniques (the "how")

Who it applies to

Defenders, red teams, and threat-intelligence analysts mapping detection and defense coverage against real-world adversary behavior — free to use for any person or organization.

How Pentforge uses it in an engagement

• Attack-path and technique mapping during a penetration test, scoped to the tactics and techniques relevant to the client's environment
• Findings referenced back to the specific ATT&CK technique ID for a shared vocabulary with the client's detection team

What you get

• A findings report mapped to specific ATT&CK technique IDs
• A coverage summary showing which tactics were exercised during the engagement

Related references

MITRE D3FEND ↗

A knowledge graph of cybersecurity countermeasures, funded by the NSA Cybersecurity Directorate and managed by MITRE's National Security Engineering Center — used as the defensive counterpart when mapping ATT&CK-derived findings to concrete countermeasures.

CWE (Common Weakness Enumeration) ↗

A community-developed list of software and hardware weakness types, sponsored by CISA/DHS and managed by MITRE — used to classify the root-cause weakness behind a finding, distinct from CVE, which catalogs specific vulnerability instances rather than weakness types.

Official source

• MITRE ATT&CK on attack.mitre.org ↗