MITRE ATLAS is a public knowledge base of adversary tactics, techniques and case studies that target AI systems. Security teams use it as a shared vocabulary: to threat model an AI feature, to plan red team exercises, and to describe an incident in terms other teams already recognise.
What is in it
The data is published in the open as the mitre-atlas/atlas-data repository. Its README describes ATLAS as "a public knowledge base of adversary TTPs targeting AI systems". The repository distributes tactics, techniques, mitigations and case studies, with typed links between them. A mitigation addresses a technique. A case study uses a technique.
At the time of review, the 2026.09 release in that repository holds 16 tactics, 208 techniques (including sub-techniques), 40 mitigations and 73 case studies. These numbers change with each release, so check the current data before you quote them.
Why a knowledge base helps
Most AI security discussions start from a list of scary outputs. ATLAS starts from what an attacker does, in order. That changes the questions you ask.
- Instead of "can the model be jailbroken?", you ask which step the attacker is on and what stops the next one.
- Instead of one big risk score, you get a list of specific techniques you can mark as covered, partly covered or open.
- Instead of a vague postmortem, you can name the techniques that were used and the mitigations that would have applied.
Four practical uses
Threat modeling. Walk the tactics in order against a diagram of your AI feature. For each one, note which techniques are plausible given the data and tools the feature touches.
Red team planning. The ATLAS mitigation called AI Red Team says exercises should use ATLAS tactics, techniques and procedures to identify relevant adversary behaviours and prioritise them by likelihood and severity.
Control mapping. Each mitigation has an ID. You can map your existing controls to those IDs and see what is missing.
Incident write-ups. The case studies show how real and demonstrated attacks are described, which gives your own reports a consistent shape.
Formats and tooling
The same repository ships the data as YAML, and its tools generate STIX JSON, Excel workbooks and ATT&CK Navigator layers. That means you can load the matrix into tools many security teams already use rather than keeping a separate spreadsheet.
The repository also documents two version numbers: a content version such as 2026.09 and a separate format version. If you build tooling on the data, pin to a content release so your coverage report does not shift under you.
What ATLAS is not
It is not a scanner, a compliance standard or a scoring system. It does not tell you how likely an attack is for your system. It gives you a structured list of things attackers have been shown to do, and you supply the judgment.
It also covers more than language models. The data includes techniques for predictive models, generative AI and agentic AI, and each technique lists the platforms it applies to.
Where to start
Pick one AI feature in production. Draw its data flows. Read the techniques tagged for Generative AI and mark which ones your design could allow. You will usually find three or four that matter and a few mitigations you already half have.
Quick check
Is ATLAS a compliance framework?
No. It is a knowledge base of adversary behaviour. You can map controls to it, but nobody certifies against it.
Do the counts of techniques stay fixed?
No. The data is released in versions such as 2026.09 and the counts change. Check the current release before you cite a number.
For a free look at the dependencies around your AI application, you can run a scan at gold.safeguard.sh/scan.
Sources
- MITRE ATLAS data repository (mitre-atlas/atlas-data), including the 2026.09 release file in its dist folder.
Last reviewed: 19 October 2026.
