What is the MITRE ATT&CK matrix and how do you use it?

The MITRE ATT&CK matrix is a table of adversary behaviour. Columns are tactics, the reasons an attacker acts, such as gaining initial access or stealing credentials. Cells are techniques, the ways they do it. Defenders use it as a shared vocabulary to find detection gaps and plan tests.

What is ATT&CK?

MITRE describes ATT&CK as a globally accessible knowledge base of adversary tactics and techniques based on real-world observations. It is used as a foundation for threat models and methodologies in the private sector, in government and in the cybersecurity product and service community.

There are separate matrices for Enterprise, Mobile and industrial control systems (ICS). The Enterprise matrix covers Windows, macOS, Linux, cloud and more. The knowledge base is versioned: the site we fetched on 18 October 2026 announced version 20, and lists earlier releases such as 19.2 and 18.1.

How is the matrix organized?

Think of three layers.

• Tactics are the columns. They answer "why?" and follow roughly the order of an intrusion.
• Techniques are the cells under each tactic. They answer "how?". Many have sub-techniques with more detail.
• Procedures are the specific ways groups or software have used a technique, listed on each technique page, along with mitigations and detection guidance.

The Enterprise matrix page we fetched on 18 October 2026 lists these tactics: Reconnaissance, Resource Development, Initial Access, Execution, Persistence, Privilege Escalation, Stealth, Defense Impairment, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration and Impact. That is fifteen. Older articles often show fourteen, with a single Defense Evasion column, so check the version when comparing sources.

What do the tactics mean in practice?

A short reading guide:

• Reconnaissance and Resource Development: preparing before touching your systems.
• Initial Access: the way in, such as phishing or a vulnerable internet facing service.
• Execution and Persistence: running code and staying after a restart.
• Privilege Escalation: gaining higher rights.
• Stealth and Defense Impairment: avoiding detection and weakening defences.
• Credential Access and Discovery: getting passwords and learning the environment.
• Lateral Movement: spreading to other systems.
• Collection, Command and Control, Exfiltration: gathering data and moving it out.
• Impact: damage, such as encryption or deletion.

A constructed example

A security team wants to test its coverage for stolen credentials. It opens the page for Valid Accounts (T1078), reads the observed uses and the suggested mitigations and detections, and lists what its own logs can see. It finds that sign-in logs are kept for seven days only, and that service account use is not monitored. Two concrete actions come out of a one hour review: extend retention and add an alert for service accounts used from new locations.

Nobody had to buy anything. The matrix gave them a structured question list.

How do teams use it?

• Detection coverage. Mark each technique you can detect, partially detect or cannot see. The gaps guide the backlog.
• Threat modelling. Choose techniques relevant to your industry and review your controls against them.
• Exercises. Plan red team or tabletop scenarios using named techniques, so results map back cleanly.
• Incident reporting. Label what happened with technique identifiers so reports are comparable.
• Intelligence. Describe actor behaviour in a common language, instead of a list of indicators that expire.

What are the common mistakes?

• Chasing full coverage. The goal is not a green matrix. Cover the techniques that matter to you first.
• Treating coverage as binary. A detection that fires only for one variant of a technique is partial.
• Ignoring data sources. You cannot detect what you do not log.
• Using it as a checklist for attackers' order. Intrusions do not follow a clean left to right path.

How to check or apply this

1. Open the Enterprise matrix and pick ten techniques from your last two incidents or from your sector's advisories.
2. For each, record what you log, which alert exists and how you tested it.
3. Rate each one: covered, partial or gap.
4. Fix the cheapest high-value gap first, usually a missing log source.
5. Rerun the review after each major change, and after each new version of the matrix.

Quick check

Sources

• MITRE ATT&CK
• MITRE ATT&CK, Enterprise Matrix
• MITRE ATT&CK, Valid Accounts (T1078)
• MITRE ATT&CK, Version history

Last reviewed: 18 October 2026.