MITRE ATT&CK Framework Explained for Business Leaders

The MITRE ATT&CK framework is a free, public catalog of the goals and methods real attackers use once they target a company, written so security teams, vendors, and leaders can describe the same attack the same way.

It isn't a product. Not a regulation. For a business leader, its most useful job is checking what a SOC as a service provider, an outside security operations center, says it watches, in terms the provider can't blur. The current version, v19.2, came out in August 2026.

Sooner or later a security proposal lands on your desk with a line about detections mapped to MITRE ATT&CK and coverage above 80%, and it's the kind of line that gets nodded through in a meeting because nobody in the room wants to be the one asking what it means. It sounds reassuring. But what's being mapped? And what counts as covered, or lives in the other 20%?

Underneath the giant color-coded matrix, the framework is simpler than it looks. Much simpler, honestly. It's a record of what attackers try to do, how they've been caught doing it, and what tends to stop them. Once that clicks, the proposal reads differently.

What Is the MITRE ATT&CK Framework?

MITRE ATT&CK, short for Adversarial Tactics, Techniques, and Common Knowledge, is a knowledge base of attacker behavior built from public reporting on real incidents. MITRE, a nonprofit that runs federally funded research centers, maintains it and gives it away.

Its license lets any company use ATT&CK for research, development, and commercial purposes without paying a royalty. That's why it turns up everywhere, from government advisories to vendor dashboards. Nobody audits you against it. Individuals can earn ATT&CK training credentials, but no company gets certified on it.

NIST CSF, written for the people who run and oversee a security program, describes what a defender should have in place. ATT&CK describes what an attacker does. Different jobs. Picture a detailed record of how break-ins have actually happened, sorted by what the burglar wanted at each step, from casing the street to carrying the television out the back door. It won't choose your locks. It tells you which doors people used.

Even MITRE is careful about its own limits. The same license states that MITRE doesn't claim ATT&CK lists every possible attacker behavior, and CISA's ATT&CK mapping guidance repeats the point in a footnote on its third page, which is exactly where an important caveat tends to hide. Some attacks won't fit anywhere. Remember that when someone quotes you a coverage percentage.

How ATT&CK Is Organized

ATT&CK has four levels. Tactics are the attacker's goal, techniques are how they reach it, sub-techniques are specific variations of a technique, and procedures are what a particular group actually did during a real, documented incident.

CISA's shorthand is easier to hold onto. Tactics are the why. Techniques are the how. And procedures, the part that makes it concrete, are the what. Every technique also carries an ID, so T1566 means Phishing whether it shows up in a government advisory, your security logs, or a vendor's slide deck, which is the whole point of having a shared vocabulary.

One detail trips people up. The tactics run left to right across the matrix, which suggests a sequence. Real attacks aren't that polite. CISA's guidance points out that an intruder can steal data first and go back to building persistence afterward. Attackers don't need every tactic, either. A crew with a working password on day one can skip half the columns and still get paid.

What Changed in 2026

Version 19 shipped on April 28, 2026. It changed the tactic list itself, which happens far less than new techniques do. The old Defense Evasion tactic, which had covered both hiding from defenders and disabling their tools, was split in two.

• Stealth (TA0005) covers hiding. The attacker is trying to look like normal activity.
• Defense Impairment (TA0112) is the one to watch. It covers breaking the security tools themselves, so your team can't see or trust what those tools report.
• AI arrived by name. Query Public AI Services (T1682) describes attackers using public AI tools for research, and Generate Content (T1683) covers producing fake personas, audio, and documents to support social engineering.

As of the v19.2 update in August 2026, the Enterprise matrix holds 15 tactics, 222 techniques, and 475 sub-techniques, according to MITRE's published ATT&CK data releases. A vendor deck that still says 14 tactics was mapped before April. That's not a scandal. It's a fair question, though.

The 15 Tactics in Plain English

Each tactic below paraphrases MITRE's own definition. The right-hand column shows how it might play out at a 200-person manufacturer running Microsoft 365, a couple of file servers, and an ERP system.

A security operations center watches for activity across all 15. Not with equal ease. Credential Access and Initial Access get close attention because that's where a stolen password turns into a breach. Discovery is harder. An attacker listing file shares looks an awful lot like an administrator doing their job during month-end close, and telling the two apart takes context about who normally does what, from where, and at what hour.

Scattered Spider, Mapped Step by Step

CISA's advisory on the Scattered Spider group describes attacks that begin with phone calls to help desks and end with encrypted servers. Every step in between maps to a named ATT&CK technique.

Scattered Spider isn't a nation-state. The joint FBI and CISA advisory on Scattered Spider, last updated July 29, 2025, describes a financially motivated group that leans on social engineering far more than on malware. The table below is a composite of the techniques that advisory lists. Think of it as a pattern, not one company's timeline.

Technique names follow ATT&CK v19.2. The advisory used v17, where T1219 was called Remote Access Software.

Nothing in that table is exotic. No zero-day exploit. Only the last step in the table needs malicious software at all, even though the advisory also lists infostealers and a remote access trojan the group has used. Five of the six steps use something the company already trusted, whether that's a phone line, an MFA app (the multi-factor sign-in prompt), a real employee account, a remote support tool the IT team installed years ago, or a mainstream storage service.

That's where ATT&CK earns its keep for someone outside security. Each technique page lists mitigations, and for this chain they're refreshingly ordinary. MITRE lists multi-factor authentication, account use policies, and user training against MFA prompt flooding, and data backup against ransomware encryption. CISA's own first recommendations are offline backups, tested regularly, and phishing-resistant MFA.

Step one's most important control isn't technical. It's how your help desk confirms who's calling before it resets a password or enrolls a new phone. That process usually starts as a sensible decision. Get people working again. Then it compounds, and a few years on, nobody remembers that the fastest reset path is also the easiest way in. Phishing was again the most common initial attack vector in IBM's 2026 Cost of a Data Breach Report. In ATT&CK, voice calls count.

ATT&CK, the Cyber Kill Chain, and NIST CSF

These three answer different questions. They don't compete. Lockheed Martin's Cyber Kill Chain and ATT&CK both describe the attacker, at very different zoom levels. The NIST Cybersecurity Framework describes the defender.

For a company with 20 to 1000 users, the split is fairly clean. CSF decides what the program should cover and how you report on it to leadership, auditors, and the insurance carrier asking questions at renewal, while ATT&CK checks whether the Detect and Respond parts of that program can actually see the techniques hitting companies like yours. Something still gets through. That's what the incident response lifecycle is for.

What ATT&CK Coverage Means in a SOC Proposal

An ATT&CK coverage number usually counts the techniques that have at least one detection rule mapped to them. It doesn't tell you whether those rules are tuned, whether they fire on your data, or whether anyone responds.

Providers tend to show coverage as a heat map. It's the ATT&CK matrix, shaded green where they have detections and red where they don't. MITRE's free ATT&CK Navigator is a common way to build one. The CPA Journal suggests a red, yellow, and green ATT&CK view for boards, and for that audience it works. A board can read one in 30 seconds.

Trouble is, green usually means a rule exists. That's all. An existing rule can still be muted after a noisy week, pointed at a log source your environment never sends, or firing into a queue nobody reads between midnight and 7 a.m. on a holiday weekend. The heat map shows none of that.

Don't chase 100%, either. MITRE's Center for Threat-Informed Defense says in its Top ATT&CK Techniques project that defending against every technique "is simply not practical." A 2023 Cyentia Institute study of 22 public threat reporting sources found that 36% of ATT&CK techniques weren't reported by any of them, and 85% of sub-techniques never appeared at all. A big slice of the matrix, at least in that window, describes behavior none of those sources reported. Unreported doesn't mean unused. It does mean nobody can tell you how much those squares matter to a company your size.

What does show up is concentrated. The same Cyentia study found Valid Accounts (T1078), attackers simply signing in with real credentials, was the most frequently observed technique, and MITRE's data lists 47 threat groups using it. Red Canary, a detection vendor, ranked cloud account abuse first in its 2026 Threat Detection Report, with malicious email forwarding and inbox hiding rules also in its top 10. One vendor's customer data. Not a census. It still points the same way.

So the better question isn't how green the map looks on a slide. It's how well the handful of techniques that hit companies your size are covered, and for nearly any business running Microsoft 365, that handful starts with identity and email abuse. Those detections live in the SIEM, the system that collects and correlates your security logs. Ask to see a few. It's a completely reasonable request.

Are the MITRE ATT&CK Evaluations a Product Ranking?

They aren't. MITRE's ATT&CK Evaluations run participating security products against emulated attacks and publish the results, but MITRE doesn't rank the vendors. Any ranking you see is someone's interpretation.

In the 2025 Enterprise evaluation, 11 vendors went up against two emulated adversaries, Scattered Spider and the China-linked group Mustang Panda, and for the first time the test included attacks on cloud infrastructure, according to SecurityWeek's coverage of the results. Three of the biggest names sat it out. Microsoft declined to participate, and Palo Alto Networks and SentinelOne withdrew.

Keep both halves in mind when a vendor quotes its results, because each half tells you something different. A strong showing counts. An absent vendor proves nothing. The vendors that sat out pointed to the resources the program demands, which is a budget call, not a detection result. How those results fit a buying decision is covered in our look at EDR software for SMBs and in the guide on how to choose an MDR provider.

Using ATT&CK in Your Next SOC or MDR Provider Review

You don't need to read the matrix to use it. These five questions work in any SOC or managed detection and response (MDR) conversation.

• Show me a real alert for T1078 or T1621. An actual detection for account misuse or MFA prompt flooding, plus what the analyst did next, says more than any heat map.
• Which ATT&CK version are your mappings on? Anything older than v19 predates the April 2026 changes. One tell is a mapping that still cites T1562, Impair Defenses, an ID MITRE retired.
• Who acts overnight? And what can they do without calling you first, like disabling an account or isolating a laptop?
• How did you decide which techniques matter most for a company like ours, as opposed to the default rule set every other client gets switched on during their first week?
• What threat reporting shapes our coverage? Manufacturers can ask whether the provider draws on sector sharing groups like MFG-ISAC, and how threat intelligence changes what gets tuned.

A good provider answers these calmly and specifically. Watch the third one closest. Detection without the authority to respond mostly produces a very well-documented incident, which is why 24/7 SOC monitoring should include containment, not just alerting.

When ATT&CK Isn't Worth Your Time Yet

If nobody at your company or your provider reviews security alerts today, skip the coverage conversation for now. A detailed map doesn't help much when nobody's driving. Start there instead.

Same for a company under 20 users without MFA on email or tested backups. Those two fixes cut into steps three and six of the Scattered Spider chain above. Neither requires a technique ID.

And if you already have an in-house security team mapping its own detections, you probably have this handled. The questions above still work as a check on your tooling vendors.