MITRE ATT&CK is a knowledge base of adversary behavior, and its own Get Started page lists four common uses: building detections and analytics, structuring threat intelligence, emulating adversaries in red and purple team work, and assessing your defenses to decide what to engineer next. Each use starts from the same shared vocabulary.
What is in the model?
ATT&CK separates why from how. Tactics are the adversary's reason for an action, such as Initial Access. Techniques are how they achieve it, for example Phishing (T1566). Sub-techniques are more specific, and procedures are real-world implementations seen in the wild. The enterprise domain covers traditional networks and cloud, with separate domains for mobile and for industrial control systems.
Every technique page also carries mitigations and, in recent versions, detection strategies with analytics. That detail makes the four uses practical.
Use 1: Detections and analytics
Take one technique and write down what it would leave behind. For Phishing, the ATT&CK detection notes suggest correlating email metadata, file creation and network activity after a message arrives. A small team can turn that into one query: an email client or document viewer starts a shell, and the shell makes an outbound connection.
Start with the three to five techniques most likely against you. Do not try to cover the matrix.
Use 2: Threat intelligence
Reports from vendors and agencies read differently, which makes them hard to compare. Mapping each to technique IDs gives you a common language. Constructed example: two advisories both mention valid accounts and remote services. You learn that identity controls matter more than another malware filter.
Use 3: Adversary emulation and red teaming
A red team can pick a real group's documented techniques and run them against you in a controlled way. ATT&CK group and software pages list procedures that were observed. Purple teaming goes one step further: attackers and defenders sit together, run a technique, and check live whether the detection fired.
Use 4: Assessment and engineering
Map your tools and logs to techniques and you get a coverage view, which shows where you are blind. It is not a score. A technique marked "covered" by a rule that nobody has tested is still unknown. MITRE describes this use as driving engineering decisions such as which tools or logging to implement.
How to check or apply this
- Choose one use first. Detection work is the usual entry point.
- Pick the five techniques most relevant to your business. Initial access and valid accounts are common starts.
- For each, record the data source needed and whether you collect it today.
- Write or review one detection per technique and test it safely in a lab.
- Track results as three states: tested and works, written but untested, and no coverage.
- Re-run each quarter, since ATT&CK versions and your systems both change. The current site shows version 20 released.
What does a first month look like?
Constructed example for a ten-person engineering company with no security staff. Week one: the founder and the lead engineer pick Phishing and Valid Accounts, because both are common techniques in ATT&CK. Week two: they check whether sign-in logs and mail logs are retained for at least ninety days, and find the identity provider keeps only seven. They change that setting. Week three: they write two detections, one for a mailbox rule that hides messages and one for a sign-in from a new country followed by a password reset. Week four: they test both with a harmless simulated event and write down the result.
None of that needed a vendor. It needed a shared model and a habit of testing.
What are the limits?
ATT&CK describes behavior, not vulnerabilities. It will not tell you whether a library in your build has a known flaw, or whether that flaw is reachable. Use it next to vulnerability and software inventory data. It also records what has been observed, so a new technique will not appear until someone reports it.
Quick check
Is ATT&CK a checklist I can finish?
No. It is a model for organizing questions. Covering every technique is neither realistic nor useful, so prioritize by what threatens your business.
Do I need a security operations team to use it?
No. A small team can start by mapping a few techniques to the logs it already has. The value comes from the shared vocabulary and from testing.
Sources
Last reviewed: 18 October 2026.
