Reconnaissance is the stage where an attacker gathers information to plan later operations. MITRE ATT&CK describes it as the adversary trying to gather information they can use to plan future operations. It covers both quiet research and active probing of a target.
- Also Called3other namesrecon · pre-attack reconnaissance · target research
- Related Terms3linked entriesAttack surface · MITRE ATT&CK
What Is Reconnaissance?
Reconnaissance is a tactic in the MITRE ATT&CK framework, a public catalog of attacker behavior. MITRE describes it as adversaries actively or passively gathering information that can be used to support targeting. The word is often shortened to recon. Defenders use the same word for the same stage, so a report that mentions recon is talking about the research an attacker does before an intrusion.
Which Reconnaissance Techniques Does MITRE List?
MITRE lists 12 techniques under this tactic. It says this intelligence supports later phases, including initial access planning. The techniques show two broad styles. Some read information that is already public. Others send traffic or messages to the target to learn from the response. The table shows eight of them.
| ATT&CK ID | Technique | What the adversary gathers |
|---|---|---|
| T1595 | Active Scanning | Probes victim infrastructure with network traffic. |
| T1592 | Gather Victim Host Information. | Host details such as operating system, software and configuration. |
| T1589 | Gather Victim Identity Information. | Employee names, email addresses and similar personal data. |
| T1590 | Gather Victim Network Information. | IP ranges, domain names and other network details. |
| T1591 | Gather Victim Org Information. | Divisions, business operations and other facts about the organization. |
| T1598 | Phishing for Information | Credentials or other data, by tricking people with messages. |
| T1596 | Search Open Technical Databases. | Domain and certificate registrations and similar public records. |
| T1594 | Search Victim-Owned Websites | Departments, locations and key staff named on the target’s own site. |
What Does Active Scanning Look Like?
MITRE describes Active Scanning as adversaries executing active reconnaissance scans to gather information that can be used during targeting. Its sub-techniques are Scanning IP Blocks, Vulnerability Scanning and Wordlist Scanning. A simple illustration: an attacker could check which of a company’s internet-facing systems answer a probe, then use that list when choosing what to target.
Why Is Recon Hard to Stop?
Reconnaissance happens before the part of an attack that most security tools are built to stop. MITRE says Active Scanning cannot be easily mitigated with preventive controls, because it is based on behaviors performed outside the scope of enterprise defenses and controls. This suggests that organizations cannot always stop recon, but they can learn what an outsider could find about them. Information that is public, such as details on a company website, can often be read without the company noticing.
How Can You See What Recon Sees of You?
MITRE’s detection advice for Active Scanning is to watch for unusual network behavior. Examples are processes with odd communication patterns, traffic that breaks protocol norms, and traffic that fits no normal operation. MITRE adds that organizations should focus on limiting external exposure of sensitive data. Because much recon uses public sources, a useful step is to review what your own organization exposes, so you know what an attacker could learn. Keeping watch on your outward-facing systems and public information is a way to see what others see. Attack surface reduction and asset discovery put that into practice.
- Monitor for atypical network behavior and unusual traffic.
- Limit what sensitive data is exposed externally.
- Review the information your organization makes public.
Is Reconnaissance the Same as Scanning?
No. Scanning is one kind of reconnaissance. MITRE lists Active Scanning as one technique among many, and others such as Phishing for Information do not involve scanning at all. Recon is the wider goal of learning about a target.
Is Reconnaissance the Same as a Vulnerability Scan?
Not exactly. A vulnerability scan checks systems for known weaknesses. MITRE lists Vulnerability Scanning as a sub-technique of Active Scanning, so an attacker can use it as part of recon. The same method is also used for legitimate checks, so the purpose and permission decide whether it is an attack.
Related Pages in the Knowledge Hub
Sources
- MITRE ATT&CK: Reconnaissance tactic: adversary trying to gather information to plan future operations; lists techniques.
- MITRE ATT&CK: Active Scanning description, sub-techniques, mitigation and detection text.
Also Called.
- Namerecon
- Namepre-attack reconnaissance
- Nametarget research
Questions.
-
What is reconnaissance in cyber security?
Reconnaissance is a tactic in the MITRE ATT&CK framework. MITRE describes it as adversaries actively or passively gathering information that can be used to support targeting. It is often shortened to recon.
-
What techniques does reconnaissance include?
MITRE lists many, including Active Scanning, Gather Victim Host Information, Gather Victim Identity Information, Phishing for Information and Search Open Websites/Domains. Some read public information, others send traffic or messages to the target.
-
Can reconnaissance be stopped?
Not easily. MITRE says Active Scanning cannot be easily mitigated with preventive controls, because it is based on behaviors performed outside enterprise defenses. It advises limiting external exposure of sensitive data.
-
How can I detect reconnaissance?
MITRE advises monitoring for atypical network behaviors, such as unusual communication patterns, traffic that deviates from established protocols, and gratuitous traffic inconsistent with normal operations.
In Our Research
- 1 BO Team Supply Chain Attack: How Intruders Reached a Software Vendor’s Signing Server November 2026
- 2 Storm-2603 ToolShell Intrusion: The Fileless Chain Inside w3wp.exe, Step by Step November 2026
- 3 Supercomputer Cryptomining: What the DOJ Alleges and How Universities Can Spot It November 2026
- 4 XCPE: How a Preloaded Android TV Backdoor Grew Into a 1.3 Million Device Botnet November 2026
- 5 CyberStrikeAI: Inside the AI Pentest Platform Used in Real Attacks November 2026
- 6 Aur0ra Ransomware’s AI Agent Intrusions: A Defender’s Task List November 2026