MITRE ATT&CK began in 2013 as an internal catalog of adversary behavior against Windows networks and now ships a major release every April and October. Recent versions reshaped the defensive side with Detection Strategies and Analytics, and v20, released 13 October 2026, adds AI-related techniques and new campaigns.
Where did ATT&CK come from?
MITRE's own FAQ says the work started in 2013 to document the tactics, techniques and procedures that advanced persistent threats use against Windows enterprise networks. It came out of a research project called FMX, which tested whether endpoint telemetry and analytics could improve detection after an intruder was already inside.
ATT&CK was the yardstick for that test, and it became a shared language for offense and defense. The version history shows v1.0 on 16 January 2018. Since then the catalog has used a major.minor scheme, where major numbers map to the April and October releases and minor numbers fix data and typos.
What changed along the way?
Three shifts stand out in MITRE's release notes.
Breadth. The October 2019 release, v6, added cloud-focused techniques. The framework had started with Windows, so this was the first sign it would follow where enterprises actually ran.
Defense, not only offense. The October 2025 release, v18, replaced the old Detections text on techniques with Detection Strategies and Analytics, reworked Data Components and deprecated Data Sources. The v18 notes list 691 Detection Strategies and 1,739 Analytics for Enterprise.
Current events. The v20 notes describe new Campaigns covering attacks on U.S. water utilities and an AI-assisted breach of Mexican government infrastructure, plus AI-focused and AI-enabled Techniques in Enterprise, and execution and command and control Techniques in ICS. Enterprise now lists 15 tactics, 227 techniques, 479 sub-techniques, 703 Detection Strategies and 1,770 Analytics.
What does a release cycle mean for your team?
A catalog that changes twice a year breaks any coverage chart that was built once and filed. Techniques get added, merged and occasionally deprecated, and v20 even un-deprecated a Mobile technique last seen in v11, so a technique ID you mapped last year may not mean what it did.
A constructed example: a detection team reports 80 percent coverage against Enterprise techniques, measured against v16. Against v20 the denominator is larger, some of their rules point to deprecated Data Sources, and a handful of new AI-related techniques have no rule at all. The number was never wrong, it was just undated.
How should you read the numbers?
Treat the counts as a sense of scale, not a target. Enterprise has grown from 216 techniques in v18 to 227 in v20, and from 14 tactics to 15. Growth in techniques does not mean growth in your exposure. It means the catalog now names more distinct behaviors, so any claim of full coverage needs a dated version and a stated scope.
Keep in mind that the catalog describes observed behavior, so a quiet technique is not a safe one. It may simply be rare, or hard to see with the telemetry that defenders have today.
How to check or apply this
- Record the ATT&CK version next to every coverage figure or detection rule mapping.
- After each April and October release, read the release notes and the changelog for objects you rely on.
- Re-map rules whose techniques were revoked, merged or deprecated.
- Move any logic that referenced Data Sources toward Data Components and the new Detection Strategies.
- Pick the new techniques that fit your environment, such as the AI-related ones if you run AI agents, and add them to the next detection sprint.
- Treat coverage as a prioritization aid, not a score. A technique mapped to a rule that has never fired in a test is a guess.
Quick check
How often does ATT&CK release?
The version history shows a major release each April and October, with minor releases in between for data corrections. v20.0 started on 13 October 2026.
Is ATT&CK a checklist to complete?
No. It is a knowledge base of observed behavior. Use it to describe what you detect and what you miss, not to chase a full matrix.
Sources
- MITRE ATT&CK FAQ
- MITRE ATT&CK version history
- ATT&CK October 2026 (v20) release notes
- ATT&CK October 2025 (v18) release notes
- ATT&CK October 2019 (v6) release notes
Last reviewed: 18 October 2026.
