MITRE ATLAS is a public knowledge base of adversary tactics and techniques that target AI systems. It follows the structure of ATT&CK. Use it to name AI threats consistently, map your controls and tests to techniques, and learn from documented case studies.
What is ATLAS?
MITRE describes the project as a public knowledge base of adversary TTPs, meaning tactics, techniques and procedures, aimed at AI systems. Its data is published openly in a GitHub repository, with tooling for parsing and validating the data and for generating other formats such as STIX, Navigator layers and spreadsheets. The content is updated monthly and versioned by year and month.
A note on terms. You may see this resource searched alongside regulatory language, because teams often need a common vocabulary for AI risk. ATLAS itself is a threat knowledge base. It is not a regulation or a compliance framework, and following it does not make you compliant with anything.
How big is it?
In the September 2026 data release, which is the latest I fetched, the file lists 16 tactics, 208 entries for techniques and sub-techniques, 40 mitigations and 73 case studies. Counts change with each monthly release, so check the current site before quoting numbers.
How is it organized?
Like ATT&CK, tactics are the adversary's goals, and techniques are how they pursue them. Some tactics are familiar from ATT&CK: Reconnaissance, Resource Development, Initial Access, Execution, Persistence, Defense Evasion, Discovery, Collection, Exfiltration, Impact, Privilege Escalation, Credential Access, Command and Control, and Lateral Movement.
Others are specific to AI. AI Model Access covers the different levels of access an adversary may have to a model, from full knowledge of its internals to indirect use through a product. AI Attack Adaptation, the other AI-specific tactic in the list, covers turning general attack methods and target knowledge into attack-ready output for a specific target.
What kinds of techniques are in it?
The data includes techniques you may recognize from the AI security literature: LLM Prompt Injection, Evade AI Model, Extract AI Model, Training Data Poisoning, RAG Poisoning, and AI Supply Chain Compromise. It also has a growing set around AI agents, such as AI Agent Tool Invocation, Poisoned AI Agent Tool, and AI Agent Context Poisoning. That reflects where deployments are heading: models that call tools and act, so a manipulated input can cause a real action.
How do you use the matrix?
Three uses stand out.
Threat modeling. For each AI system, walk across the tactics and ask which techniques apply. A customer-facing chatbot raises prompt injection and data extraction. A model trained on scraped data raises poisoning. An agent with tool access raises tool invocation and credential issues.
Control mapping. The mitigations in ATLAS give you a starting list of defenses, linked to the techniques they address. Map your existing controls to them and note gaps.
Testing and training. Use the case studies to design red team exercises and to brief engineers on real incidents, instead of invented ones.
A constructed example
A support team deploys an assistant that reads customer emails and can issue refunds through an internal tool. The security lead walks the matrix. Under Initial Access and Execution she finds prompt injection through email content. Under the agent-related techniques she finds tool invocation and context poisoning. She writes three test emails that try to steer the assistant into a refund, and runs them against a staging copy. One succeeds. The fix is not a smarter prompt but a limit: refunds above a small amount need a human click, and the assistant's tool credentials are scoped to refund creation only. She records the technique IDs in the test report so the next review starts from them.
How to check or apply this
- List your AI systems and what each can read, write and call.
- Walk the ATLAS tactics for each system and mark applicable techniques.
- Write one test per high-priority technique and run it on a non-production copy.
- Map mitigations to your controls and record gaps with owners.
- Reference technique IDs in findings so teams share vocabulary.
- Re-check when ATLAS publishes updates, at least quarterly.
- Use ATT&CK for the conventional infrastructure around the model, and ATLAS for the AI-specific parts.
Safeguard's MCP Guardrail and agent identity features are aimed at the agent tool and permission side of this problem. They address part of the picture. Model-level testing still needs its own work.
Quick check
Is ATLAS a compliance framework?
No. It is a knowledge base of adversary behavior against AI systems. It does not certify or regulate anything.
How does ATLAS relate to ATT&CK?
It follows the same tactic and technique structure and shares many tactic names, with added tactics and techniques specific to AI.
Sources
Last reviewed: 18 October 2026.
