MITRE ATT&CK is organized into three technology domains: Enterprise for traditional networks and cloud, Mobile for mobile devices, and ICS for industrial control systems. Choose the matrix that matches the systems you defend, then map your detections and tests to its techniques, not to one generic list.
What is ATT&CK in one paragraph?
MITRE describes ATT&CK as a knowledge base of adversarial techniques based on real-world observations. It models behavior with four parts. Tactics are the "why", the reason an adversary takes an action. Techniques are the "how". Sub-techniques are more specific descriptions. Procedures are the specific ways a real adversary used a technique. The site notes that ATT&CK v20 has been released, so check the version your tooling uses.
What is a technology domain?
A domain is the ecosystem an adversary operates in. Within each domain, platforms are operating systems or applications, and a technique can apply to several platforms. This is why one security team can use more than one matrix without conflict. The structure is shared, the content differs.
Platforms are the finer filter. Inside Enterprise, for example, a technique may apply to Windows, Linux, macOS or cloud services, and a detection written for one may not work on another. When you record coverage, note the platform as well as the technique, or the sheet will overstate what you can see.
What does each matrix cover?
Enterprise represents traditional enterprise networks and cloud technologies. Its tactics run from Reconnaissance and Resource Development through Initial Access and Execution, on to later stages of an intrusion. Most security operations teams start here, because their endpoints, identity systems and cloud accounts live here.
Mobile covers mobile communication devices. If your staff handle sensitive data on phones, or you ship a mobile app, its techniques describe how adversaries target those devices, and they differ from desktop techniques in how code gets installed and what access it has.
ICS covers industrial control systems. Plants, utilities and building systems have different priorities, such as safety and availability, and different protocols and devices. A technique list written for a Windows domain does not describe them well.
Which one should you start with?
Follow your assets, not the headline. A software company with cloud workloads and a mobile app needs Enterprise first and Mobile for the app and the device fleet. A manufacturer needs ICS for the plant floor and Enterprise for the office network that connects to it. Many organizations need two matrices and a clear boundary between them.
A constructed example
A regional water utility has a corporate network, a SCADA environment and field technicians with tablets. The security lead builds a coverage sheet with three tabs, one per domain. On the Enterprise tab she marks which initial access and credential techniques her email and identity logs can detect. On the ICS tab she finds that most techniques have no detection at all, because the plant network has no monitoring. That gap becomes the project for the year. Without separate tabs the Enterprise detections would have made the overall coverage look healthy.
How should you not use it?
MITRE has a section on how not to use ATT&CK, and its advice applies to every domain. Do not try for 100 percent coverage, because every organization faces its own threats and not every technique applies to everyone. Do not declare success when you have found one way an adversary performs a technique, because most techniques can be carried out in several ways. Prioritize what is most relevant to you and test depth, not box count.
How to check or apply this
- List your asset groups: corporate IT, cloud, mobile, industrial.
- Match each group to a domain and choose the platforms inside it.
- For each priority technique, record the log source that would show it, and whether anyone reviews that source.
- Run a test for each detection and record the result with the date.
- Review your mapping when ATT&CK publishes a new version.
Quick check
How many ATT&CK domains are there?
MITRE currently lists three: Enterprise, Mobile and ICS.
Is a technique the same as a tactic?
No. A tactic is the adversary's goal at a stage. A technique is how they pursue it.
Sources
- MITRE ATT&CK, Get Started
- MITRE ATT&CK Enterprise matrix
- MITRE ATT&CK Mobile matrix
- MITRE ATT&CK ICS matrix
Last reviewed: 18 October 2026.
