New: Pressure test your SOC 2 report against buyer requirements
Free check
The MITRE ATT&CK framework is a publicly accessible knowledge base of adversary tactics, techniques, and procedures (TTPs) based on documented real-world cyberattacks. Maintained by MITRE, a not-for-profit research organization, ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) provides a structured language for describing how attackers behave at each stage of a compromise, from initial access through impact.
The MITRE ATT&CK framework is a globally accessible knowledge base that catalogs the specific behaviors adversaries use when attacking real systems. MITRE, a federally funded research and development organization that provides technical guidance to the US government, began developing ATT&CK in 2013 based on internal research into Windows enterprise attacks and released it publicly in 2015. Security teams, detection engineers, red teamers, and tool vendors across the industry have adopted it as the standard vocabulary for describing attacker behavior.
The name breaks down directly: Adversarial Tactics, Techniques, and Common Knowledge. Tactics represent the adversary's goals at each stage of an attack (the "why"). Techniques are the specific methods used to achieve those goals (the "how"). Common Knowledge is the underlying premise: the framework is built from documented observations of how real attackers actually operate, not theoretical attack models.
ATT&CK is organized into multiple matrices. The Enterprise matrix covers attacks against traditional IT networks, endpoints, cloud environments, and containers. The Mobile matrix covers threats targeting mobile devices. The ICS matrix covers attacks against operational technology and critical infrastructure. For most startups, the Enterprise matrix is the most relevant reference.
Tactics are the highest-level categories in the framework. Each tactic represents an adversary's objective at a particular stage of an attack. The current ATT&CK Enterprise matrix contains 14 tactics:
Under each tactic, ATT&CK documents specific techniques: the methods an adversary might use to accomplish that tactic's goal. Phishing (T1566) appears under Initial Access; OS Credential Dumping (T1003) appears under Credential Access. Many techniques have sub-techniques that describe more specific variations. The current Enterprise matrix contains over 200 techniques and more than 400 sub-techniques.
Each technique entry includes a description, examples drawn from real incidents and threat intelligence reports, detection recommendations (what data sources and log fields indicate this technique in use), and mitigation recommendations (controls that reduce the risk of this technique succeeding).
Procedures are the concrete, real-world implementations of techniques. The ATT&CK database links specific threat actor groups and malware families to the techniques they use, based on published threat intelligence. This makes it possible to look up a known threat actor (e.g., APT29, also known as Cozy Bear) and see exactly which techniques they have been observed using in documented attacks, which in turn informs detection and defense priorities.
Security teams use ATT&CK in a few distinct ways:
Detection engineering: Security teams map their detection coverage to ATT&CK techniques to identify gaps. If a tactic or technique is not covered by any detection rule, it represents a blind spot an attacker could exploit without being seen.
Threat hunting: Threat hunters use ATT&CK as a structured guide for proactive investigation. Knowing which techniques a likely threat actor uses allows hunters to look for specific evidence in logs and telemetry, rather than searching without direction.
Red team and adversary simulation: Penetration testers and red teams use ATT&CK to structure realistic attack scenarios that simulate actual adversary behavior rather than opportunistic exploitation.
Tool evaluation: Organizations use ATT&CK coverage maps to evaluate security vendors, checking which techniques a proposed tool detects versus which it misses.
Fencer's security monitoring capability is built around ATT&CK-aligned detection rules, mapping observed events to specific tactics and techniques so findings carry meaningful context rather than raw log data. The threat hunting interface lets security engineers query logs with ATT&CK techniques in mind. For startups that want to understand their detection coverage against the ATT&CK framework, Fencer's built-in detection logic provides structured coverage across the tactics most relevant to cloud-native, developer-operated environments.
No. CVE (Common Vulnerabilities and Exposures) is a catalog of specific software vulnerabilities, each with a unique identifier and severity score. It documents what can be exploited. MITRE ATT&CK documents how attackers behave during an attack, including the techniques they use to exploit systems, move laterally, steal credentials, and accomplish their goals. The two systems are complementary: a CVE might describe a specific vulnerability that enables ATT&CK technique T1203 (Exploitation for Client Execution). Security teams use both: CVEs to prioritize patch management, and ATT&CK to map detection and response capabilities.
Two approaches work well here. First, look at which threat actor groups target organizations like yours (similar industry, size, technology stack) and focus on the techniques those groups use most frequently. MITRE publishes group profiles in the ATT&CK database with technique mappings based on real incident reporting. Second, use CISA's guidance and advisories, which regularly reference specific ATT&CK techniques used in campaigns targeting particular sectors. For cloud-native startups, prioritizing techniques in the Initial Access, Credential Access, and Cloud Service categories is usually a reasonable starting point, since these align with the most common attack patterns against SaaS-heavy, cloud-hosted environments.
Possibly, but coverage gaps are common and often unexamined. Most SIEM vendors map their detection rules to ATT&CK technique IDs, but the coverage is rarely complete, and it is easy to assume coverage exists where it does not. The right approach is to review your SIEM's detection rules against the ATT&CK matrix for the tactics and techniques most relevant to your environment, identify gaps, and prioritize filling them based on threat actor relevance and potential impact. Running a threat hunting exercise or engaging a red team to test actual detection coverage is more reliable than taking a vendor's ATT&CK coverage map at face value.
