What is MITRE ATLAS and which techniques matter to defenders?

MITRE ATLAS is a public knowledge base of adversary tactics and techniques against AI systems, organized like ATT&CK. It groups techniques under tactics such as Reconnaissance, Initial Access, Execution and Exfiltration, and includes mitigations and case studies. Defenders use it to map threats and check coverage.

What is in ATLAS?

The project's data repository describes ATLAS as a public knowledge base of adversary tactics, techniques and procedures targeting AI systems. The data covers tactics, techniques, mitigations, case studies and relationships between them, and the repository ships tooling to export it to STIX, ATT&CK Navigator layers and spreadsheets.

Content is versioned by year and month. The repository examples show content version 2026.05. Technique counts change as the project adds entries, so we do not quote a total.

How are the tactics organized?

An older release of the data (version 5.6.0, which MITRE marks as deprecated in favor of the repository's current files) lists sixteen tactics: Reconnaissance, Resource Development, Initial Access, AI Model Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, AI Attack Staging, Command and Control, Exfiltration and Impact.

Most will look familiar if you know ATT&CK. Two are specific to AI: AI Model Access, which is about how an adversary reaches the model, and AI Attack Staging, which is about preparing an attack against it. Check the live matrix for the current list.

Which techniques should you read first?

You do not need all of them on day one. A practical starting set, taken from technique names in that release:

• AI Supply Chain Compromise and Publish Poisoned Models, which are about what you download.
• LLM Prompt Injection and LLM Jailbreak, about how inputs steer a model.
• LLM Data Leakage and Extract LLM System Prompt, about what comes out.
• AI Agent Tool Invocation, about a model being driven to use its tools.
• RAG Poisoning, about corrupted retrieval sources.
• Exfiltration via AI Inference API, about abuse of an exposed model endpoint.
• Cost Harvesting and Denial of AI Service, about availability and spend.

These line up closely with the OWASP LLM risks for the same reason: they describe the same ground from two angles. OWASP is a risk list for builders. ATLAS is an adversary behavior catalog for defenders.

How do you use it in practice?

Build a small table. Rows are the techniques you selected. Columns are: where it could happen in your system, which control would stop or detect it, who owns that control and how you know it works.

Blank cells are your work plan. A technique with no detection is a gap you can name in a meeting, which beats a vague worry about AI risk.

Use it for exercises too. Pick one technique per quarter and walk through it with the team that owns the system, asking what logs would show and who would notice.

What does ATLAS not do?

It does not rank techniques for your business, and it does not tell you what to buy. It is a shared vocabulary. It also does not replace ordinary controls: access management, network boundaries and logging still carry most of the load.

What to do

1. Open the ATLAS matrix and pick ten techniques relevant to your AI features.
2. For each, write where it could occur and what control covers it.
3. Mark controls with no detection or no owner.
4. Pair each technique with the matching OWASP LLM risk for builders.
5. Export a Navigator layer so coverage is visible to leadership.
6. Revisit the list when ATLAS publishes a new content version.

Quick check

Sources

• MITRE ATLAS, the live matrix.
• mitre-atlas/atlas-data repository, fetched 18 October 2026, including the data release noted above.

Last reviewed: 18 October 2026.