MITRE ATT&CK® framework
Also written: ATT&CK
A knowledge base of adversary tactics and techniques based on real-world cyberattack observations.
The MITRE ATT&CK framework is like a catalog of bad actor moves in computer security. It lists common ways attackers try to get into systems, steal data, or cause damage.
For example, one technique might be 'phishing,' where an attacker tricks someone into clicking a bad link. Another could be 'credential dumping,' where they try to steal login information.
MITRE ATT&CK is a globally accessible knowledge base of adversary tactics and techniques. It is built upon real-world observations and aims to provide a common language for describing cyberattacks. The framework organizes techniques under tactics, which represent the adversary's high-level goals (e.g., Initial Access, Execution, Persistence). Each technique has associated procedures, mitigations, and detection strategies.
It serves as a foundation for threat modeling, detection engineering, and adversary emulation. While comprehensive, its breadth can be a challenge, and mapping specific AI-driven threats to its existing structure requires careful analysis.
Recent research, like that from Anthropic, is using the MITRE ATT&CK framework to understand and categorize new cyber threats enabled by AI. This helps security professionals adapt existing defense strategies to novel attack methods.
- Mapping AI-enabled cyber threatsAnthropic · Anthropic Research ·
- Anthropic Claude
- Anthropic research uses the MITRE ATT&CK framework to map AI-enabled cyber threats.
- Common Vulnerabilities and Exposures (CVE)
- CVE identifies specific software wea
The MITRE ATT&CK framework was developed by MITRE, a non-profit organization that operates federally funded research and development centers. It is based on real-world observations of adversary behavior. Source ↗
You can explore the MITRE ATT&CK website to look up specific tactics like 'Phishing' or 'Credential Access'. Then, try to think about how an AI might be used to automate or enhance these techniques, such as generating more convincing phishing emails.
The Playbook: reusable how-tos, prompts, configs and tips pulled out of the news.
- PromptRole-play a student struggling with math for AI tutor simulationSimulate a student's math struggles and uncertainty for AI tutor evaluation. · 5 min
- TemplateReusable workflow templates for healthcare teamsTeams can create and share templates for common workflows like documentation or prior authorizations. · 15 min
- TemplateTemplate for building an AI tool tailored to your workA structured approach to defining and building a custom AI tool for specific business needs. · 15 min
- TemplateEvals CSV prompt list for agent skillsA CSV file template for listing prompts used in evaluating agent skills. · 20 min
- HeuristicDouble coding agent task completion with docs linksProviding coding agents with a documentation link significantly increases their task completion rate. · 2 min
Questions people ask
- What is a tactic in ATT&CK?
- A tactic represents the adversary's high-level objective or reason for performing an action, such as gaining initial access or maintaining persistence.
- What is a technique in ATT&CK?
- A technique describes a specific method an adversary uses to achieve a tactic, like using spearphishing attachments to gain initial access.
First seen on Subvolts Jun 26, 2026. Updated Sep 14, 2026. Written by an AI model from the items above and reviewed against them weekly; report an error.