Cyber attacks are easiest to understand by goal, not by name. Phishing, malware, denial of service and injection are methods. What the attacker wants is access, credentials, persistence, data or disruption. MITRE ATT&CK organises this into 15 enterprise tactics, which is a better map than an alphabetical list.
Why sort by goal?
Names multiply. Every year brings a new label for an old technique. Goals stay stable. MITRE describes tactics as the "why" of a technique: the adversary's tactical goal, the reason for performing an action. A single incident usually touches several of them in order.
The current enterprise matrix on the ATT&CK site lists 15: Reconnaissance, Resource Development, Initial Access, Execution, Persistence, Privilege Escalation, Stealth, Defense Impairment, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration and Impact. Older versions had fewer and different names, so check the version your tooling maps to.
Which attacks get an attacker in?
Phishing and social engineering trick a person into handing over a password or running a file. CISA publishes guidance on avoiding social engineering and phishing attacks, and these remain a common way in.
Exploiting a vulnerability in an internet facing system needs no human at all. CISA's Known Exploited Vulnerabilities catalogue is a list of flaws with evidence of active exploitation, and it is a practical sign of which kinds of bugs attackers use first.
Stolen or guessed credentials work because passwords get reused. A second factor stops the simplest form of this.
Supply chain compromise gets in through something you trust: a dependency, a build tool, an update channel. The attacker never touches your perimeter.
Which attacks keep and widen access?
Once inside, the goals are to stay, to gain more permission and to move. Persistence means a scheduled task, a new account or a modified startup item. Privilege escalation exploits a local bug or a misconfigured role. Lateral movement reuses credentials to hop between machines.
The new Stealth and Defense Impairment tactics in ATT&CK describe hiding and breaking logging or pipelines so defenders cannot see what is happening. Attacks on your security tooling belong in the threat model.
Which attacks take or damage things?
Data theft collects and sends out information. Ransomware encrypts data and demands payment, which sits under Impact. Denial of service floods a target until legitimate users cannot reach it. CISA describes a SYN flood, where connection requests are never completed, and a Smurf attack, which uses spoofed ICMP broadcast packets, as examples. Wipers destroy data with no payment in mind.
Man-in-the-middle attacks intercept or alter traffic between two parties, and injection attacks such as SQL injection feed crafted input to an application so it runs the attacker's instructions.
A constructed chain
Picture a regional retailer. An accounts clerk gets an invoice email and enters their password on a fake page (Initial Access, Credential Access). The attacker logs in to webmail, sets a forwarding rule (Persistence) and reads supplier messages (Collection). Weeks later they send a convincing payment change request from the real mailbox (Impact).
No malware appeared, and no exploit. A list of attack types would call this phishing. A goal map shows five stages where a control could have stopped it: phishing resistant login, alerts on new forwarding rules, and a call back procedure for bank detail changes.
What should defenders do with this?
Use tactics as a checklist for coverage. For each one, ask what you could see and what you could stop. Most teams find strong controls at the edge and weak ones for credential misuse and lateral movement.
How to check or apply this
- Write down the 15 tactics and mark what telemetry you have for each.
- Pick your three likeliest incident types and trace them through the tactics.
- Add one detection or one prevention for each stage you cannot cover.
- Review the KEV catalogue against your own internet facing software.
- Test the weakest chain with an exercise, not a policy review.
- Re-map when your tooling updates to a new ATT&CK version.
Quick check
Is phishing a type of attack or a tactic?
It is a technique under Initial Access in ATT&CK. The goal is getting in, and phishing is one way to do it.
Do all attacks involve malware?
No. Attacks using stolen credentials and legitimate tools can leave no malware at all, which makes behavioural logging important.
Sources
- MITRE ATT&CK, Enterprise tactics
- CISA, Avoiding Social Engineering and Phishing Attacks
- CISA, Understanding Denial-of-Service Attacks
- CISA, Known Exploited Vulnerabilities Catalog
- NIST glossary, zero-day attack
Last reviewed: 18 October 2026.
