Log in Request a demo

Glossary

MITRE ATT&CK.

Also called ATT&CK, ATT&CK framework, MITRE ATT&CK framework, MITRE ATTACK

In Short

MITRE ATT&CK is a globally-accessible knowledge base of adversary tactics and techniques based on real-world observations. MITRE says it is open and available to any person or organization at no charge. Security teams can use it to describe attacker behavior with shared names.

Last updated October 8, 2026
Profile MapGlossary Term
  1. Also Called4other namesATT&CK · ATT&CK framework · MITRE ATT&CK framework
  2. Related Terms2linked entriesThreat intelligence

What is MITRE ATT&CK?

MITRE says ATT&CK is a globally-accessible knowledge base of adversary tactics and techniques based on real-world observations. An adversary is the person or group carrying out an attack. A knowledge base is an organized collection of information that people can look things up in. MITRE’s FAQ describes it as a knowledge base of cyber adversary behavior and a taxonomy, which means a shared way of naming and sorting, for adversarial actions across their lifecycle.

Who makes it and who can use it?

The MITRE Corporation developed and maintains ATT&CK. According to its FAQ, the work started in 2013 to document common tactics, techniques and procedures used by advanced persistent threats. MITRE says ATT&CK is open and available to any person or organization for use at no charge. It also says the knowledge base is used as a foundation for threat models and methodologies in the private sector, in government, and in the cybersecurity product and service community.

What are tactics and techniques?

MITRE explains that a tactic is the “why”. It is the adversary’s tactical goal, the reason for performing an action. A technique is the “how”. It is the way an adversary achieves a tactical goal by performing an action. Some techniques also have sub-techniques, which describe a more specific way of doing the same thing.

How is the knowledge base organized?

The site groups its content into matrices. A matrix is a table that lays out tactics and the techniques under them. MITRE publishes three: Enterprise, Mobile and ICS, which stands for industrial control systems. The Enterprise tactics listed on the site are Reconnaissance, Resource Development, Initial Access, Execution, Persistence, Privilege Escalation, Stealth, Defense Impairment, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration and Impact.

What is it used for?

MITRE says ATT&CK can be used in several ways to help security operations, threat intelligence and security architecture. As a simple illustration, a team could describe an incident by listing the tactics and techniques it saw, so that others can read the same description with the same names. MITRE says the data comes from publicly available threat intelligence and incident reporting. It also says the knowledge base is available through APIs, which let software read it.

Is MITRE ATT&CK the same as a list of threats?

No. It does not list individual attacks one by one. It describes adversary behavior, the actions taken, in a structured way. Related terms are tactics, techniques and procedures, and threat intelligence.

Is MITRE ATT&CK free to use?

Yes. MITRE states that ATT&CK is open and available to any person or organization for use at no charge.

Does ATT&CK only cover company networks?

No. MITRE’s home page shows three matrices, Enterprise, Mobile and ICS, so the knowledge base covers more than one kind of environment.

Also Called.

  • NameATT&CK
  • NameATT&CK framework
  • NameMITRE ATT&CK framework
  • NameMITRE ATTACK

Questions.

  • What is MITRE ATT&CK?

    MITRE says ATT&CK is a globally-accessible knowledge base of adversary tactics and techniques based on real-world observations. Its FAQ also calls it a taxonomy for adversarial actions across their lifecycle.

  • Is MITRE ATT&CK free to use?

    Yes. MITRE states that ATT&CK is open and available to any person or organization for use at no charge. Users must follow its Terms of Use and may not imply MITRE endorses their products.

  • What matrices does ATT&CK have?

    MITRE publishes three matrices: Enterprise, Mobile and ICS, which stands for industrial control systems. A matrix is a table of tactics and the techniques under them.

  • What is the difference between a tactic and a technique?

    A tactic is the why, the adversary's goal for an action. A technique is the how, the way the adversary reaches that goal. Some techniques have more specific sub-techniques.

Sources

  1. 1 FAQ | MITRE ATT&CK®, MITRE
  2. 2 Persistence, Tactic TA0003 - Enterprise | MITRE ATT&CK, MITRE

In Our Research

  1. 1 Software Shared Across ATT&CK Groups: Reuse Study October 2026
  2. 2 ATT&CK groups by attributed origin: what is mapped October 2026
  3. 3 ATT&CK techniques most used across threat groups October 2026
  4. 4 Why Ransomware Fragmentation Makes Attribution Harder Than Ever August 2026
  5. 5 WIRTE: Covert Espionage Actor Targeting the Middle East and Beyond July 2026
  6. 6 The Breakout Window: How Long Does an Attacker Have Inside Your Network? June 2026

Keep Exploring.

Knowledge Hub
101 guide Threat Intelligence Requirements (PIR) Template (Free DOCX) A free PIR template for a small team: how to write a priority intelligence requirement, 10 starter PIRs, an interview sheet, metrics and a quarterly review checklist. Open Role Incident Response And Threat Hunting Follow an alert to the actor behind it, with indicators, techniques and leaked access in one place, so a review starts from facts. Open Glossary term Command And Control (C2) Command and control (C2) is how an attacker communicates with systems they have compromised in order to control them. Open Glossary term Lateral Movement Lateral movement is when an attacker who has gained access to one system moves on to other systems and accounts in the same network. Open

Browse The Library.