Use the ATT&CK Enterprise matrix for office networks, servers and cloud services, the Mobile matrix for phones and tablets, and the ICS matrix for industrial control systems. Many organisations need more than one. Choose by what you operate, not by what a report happens to cover.
What MITRE says each covers
MITRE's resources page describes ATT&CK as a knowledge base of adversarial techniques based on real-world observations. It links a matrix for each domain:
- Enterprise: traditional enterprise networks and cloud technologies.
- Mobile: mobile communication devices.
- ICS: industrial control systems.
Within each domain are platforms, such as operating systems or applications, and a technique can apply to several platforms. MITRE also states that the matrix documents only observed real-world behaviours.
How to choose
Start from your asset list. Count what you actually run.
- Mostly laptops, servers, SaaS and cloud accounts: Enterprise.
- A managed phone fleet that reaches company data: add Mobile.
- Factory, plant, building or lab equipment with controllers: add ICS.
Then look at where the damage would land. A phone compromise may expose email and tokens. An industrial system compromise may affect physical processes. Weight your effort by consequence, not by the number of techniques in each matrix.
The tactic layer
Tactics describe why an adversary acts, techniques describe how, and procedures describe the specific in-the-wild uses. Comparing matrices at the tactic level is a good first step, since tactics read the same way even when techniques differ.
MITRE has been revising the Enterprise tactic list. At the time of writing, the Enterprise tactics page lists 15, including Stealth and Defense Impairment. Check the live page, because names and counts can change between releases.
Platform filters beat reading everything
Filter by platform before you review. If you have no macOS servers, hide macOS. Otherwise the matrix looks like a wall and your review becomes shallow.
Common mistakes
- Using only Enterprise when you have a plant floor.
- Importing a threat report without checking which matrix its techniques belong to.
- Treating a technique count as a risk score.
- Forgetting that a mobile device can be a path to cloud accounts, which sit in the Enterprise matrix.
A short plan
- List the platforms you run.
- Match each to a matrix.
- Pick one threat report per matrix that is relevant to you.
- Mark its techniques, as in the Navigator how-to linked below.
- Review annually or when your estate changes.
See how to build a detection coverage layer in ATT&CK Navigator for the working method.
Quick check
Do I need the ICS matrix if I only run office IT?
Usually not. Add it if you operate or depend on industrial control equipment.
Is the technique count in a matrix a measure of danger?
No. Count says nothing about how likely or how harmful each technique is for you.
Sources
Last reviewed: 19 October 2026.
