ATT&CK stands for Adversarial Tactics, Techniques, and Common Knowledge. It is published by the non-profit MITRE Corporation, which also manages the CVE program. The database is free for everyone to use and is expanded regularly; the current version 20 was released on October 13, 2026. There are three matrices: Enterprise for classic IT and cloud, Mobile for smartphones, and ICS for industrial control systems.
How is ATT&CK structured?
- Tactic: the why, that is, the goal of a step, such as initial access or privilege escalation.
- Technique: the how, for example T1566 Phishing or T1190 exploiting an internet-facing application.
- Sub-technique: a more specific variant, such as T1110.004 credential stuffing as a sub-case of brute force.
- Procedure: how a specific group actually implemented the technique, backed by sources.
For each technique, ATT&CK lists countermeasures (mitigations) and detection strategies. In version 20, the Enterprise matrix comprises a total of 227 techniques and 479 sub-techniques.
The 15 tactics of the Enterprise matrix
In version 20, the Enterprise matrix is divided into 15 tactics: Reconnaissance, Resource Development, Initial Access, Execution, Persistence, Privilege Escalation, Stealth, Defense Impairment, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration, and Impact. Up to version 18, there were 14 tactics, at that time still with Defense Evasion in place of Stealth and Defense Impairment. If you use older reports or analyses, you should therefore pay attention to the version.
What is ATT&CK used for?
- Plan detection: A security operations center or SIEM team maps its rules to techniques and can thus see where gaps exist.
- Classify threat intelligence: According to MITRE, ATT&CK provides a common language to structure and compare threat information.
- Design tests: Penetration tests and red team exercises specifically replicate techniques that are relevant to your own industry.
- Show coverage: The free ATT&CK Navigator highlights in the matrix which techniques are detected or prevented.
In practice for SMEs and municipalities
No one has to cover all techniques. It makes more sense to focus on common entry paths: phishing (T1566), exploiting services at the network edge (T1190), valid but stolen accounts (T1078), and external remote services (T1133). For push spam to the smartphone, there is a separate technique, T1621, see MFA Fatigue. Ask your service provider which of these techniques your safeguards detect or prevent, and have them show you on the matrix.
Limitations
ATT&CK is a reference work, not a checklist and not a maturity model. A highlighted technique in the matrix does not say how well it is detected. The tactics are deliberately unordered; a real attack does not follow a fixed sequence. According to MITRE, ATT&CK and the phase model of the Cyber Kill Chain complement each other, with ATT&CK providing the more granular level of description.
How TOMORIS relates
EXPERTS Cyber Security prioritizes safeguards by impact and prepares detection, reporting, and response together with your team. Training on typical attack paths is offered by UNIVERSITY Cyber Security.