MITRE ATT&CK

What it is

MITRE ATT&CK organises adversary behaviour observed in real intrusions into a structured matrix. The Enterprise matrix, the most widely used, groups techniques under tactics representing an attacker's objective at a given stage. As of 2026-09 the Enterprise matrix on the site shows 15 tactics, running from Reconnaissance and Initial Access through Persistence, Stealth, Discovery and Lateral Movement to Exfiltration and Impact. MITRE revises the tactic list from time to time, so the matrix on the site is the source of truth. Each tactic contains many specific techniques and sub-techniques (for example, a particular way of achieving persistence), each documented with real examples of threat groups and malware known to use it, along with suggested detections and mitigations. Separate matrices exist for Mobile and for Industrial Control Systems (ICS).

Why it matters

Before ATT&CK, different vendors and teams described the same attacker behaviour with different, incompatible language. ATT&CK gives the industry a shared vocabulary: a SOC analyst, a red teamer, and a security vendor's product documentation can all reference "T1059" (command and scripting interpreter) and mean the exact same thing. That shared reference is why it shows up everywhere in modern security work, from threat intelligence reports and SIEM detection rules to how LetsDefend and similar platforms tag their own exercises.

ATT&CK Navigator

Alongside the knowledge base itself, MITRE publishes ATT&CK Navigator, a free browser based tool for visualising and annotating the matrix, commonly used to map which techniques an organisation currently has detection coverage for, or which techniques a specific threat group is known to use, as a heat map over the full matrix.

Free versus paid

Completely free. MITRE states that "ATT&CK is open and available to any person or organization for use at no charge", with the underlying data also available for anyone building tools on top of it.

Who it suits

Best approached after some foundational security exposure, since ATT&CK is a reference and classification system rather than a tutorial; it rewards someone who already understands roughly what privilege escalation or lateral movement means and wants a structured way to think and communicate about it. SOC analysts, threat intel analysts, red and blue teamers, and security engineers building detections all use it directly.

Common questions

Is it a training course? No, it is a knowledge base and reference framework; platforms like LetsDefend or Hack The Box Academy are better starting points for hands on skill building, with ATT&CK as the shared vocabulary layered on top. Does it change often? Yes, MITRE updates it regularly as new techniques and threat groups are documented, so check the version notes on the site rather than assuming a static reference. Is it only for advanced practitioners? No, but it is more useful once you have some grounding in how attacks actually unfold.