What Is the MITRE ATT&CK Framework?

By modeling adversaries’ actions throughout the attack lifecycle, it helps organizations better understand potential threats, prioritize defenses, and strengthen their overall security posture. Specifically, it is designed to help you:

• Understand known and emerging adversary behaviors
• Recognize and stop threats
• Identify gaps in security defenses
• Reduce vulnerabilities
• Develop customized threat models

Provided to the public for free by MITRE, a nonprofit organization, the framework was first released in 2015 with an initial focus on Windows enterprise system threats. Today, it spans Linux, macOS, cloud platforms, mobile devices, and industrial control systems (ICS). MITRE continuously maintains and updates the knowledge base twice a year with input from a global community of cybersecurity professionals. For example, in 2025 MITRE released version 17, which incorporates emerging malicious behaviors such as exploiting generative AI.

Where Does the Data in the MITRE ATT&CK Framework Come From?

The knowledge base is built from publicly available data, threat intelligence, and incident reporting, as well as research on new TTPs contributed by threat researchers, analysts, and security teams across the global community.

Security teams can ingest this data directly into automated workflows using Structured Threat Information Expression (STIX™), a standardized machine-readable format. For human analysis and manual reference, ATT&CK data is also available in Microsoft Excel spreadsheets.

While the MITRE ATT&CK framework is an expansive knowledge base, its matrices serve as condensed, graphical versions of this information. Each matrix captures a distinct scope of attacker behavior and is color-coded to illustrate how frequently a technique is used, its severity in an actual attack, and the defensive controls available for mitigation.

Enterprise Matrix

The Enterprise Matrix spotlights tactics and techniques employed against traditional IT and modern enterprise infrastructure, covering Windows, macOS, Linux, cloud environments (such as IaaS and SaaS), networks, and containers. This matrix also incorporates PRE-ATT&CK—a previously separate matrix detailing the early stages of a cyberattack prior to compromise. By mapping detected activity to the 14 tactics in the Enterprise Matrix, analysts gain valuable insight into how an adversary might exploit a target system.

Mobile Matrix

Because smartphones and tablets store vast amounts of sensitive data, the Mobile Matrix dives into the unique ways attackers compromise Android and iOS platforms. It highlights mobile-specific attack vectors, including malicious apps, configuration exploits, network reconnaissance, privilege escalation, and data exfiltration.

ICS Matrix

When industrial control systems (ICS) are at risk, disruptions can extend far beyond data breaches into manufacturing outages or public utility failures. The ICS Matrix focuses on tactics and techniques used to attack critical infrastructure networks, such as power grids, energy, transportation, and communications systems, helping teams tailor security controls to prevent physical consequences.

Tactics, Techniques, and Procedures (TTPs)

Within each matrix, adversarial behaviors are organized into a shared hierarchy:

• Tactics represent the "why" of an attack—the short-term objectives adversaries aim to achieve in sequence (for example, using privilege escalation to gain higher-level permissions).
• Techniques address the "how"—the specific methods adversaries use to carry out a tactic, such as spear phishing or exploiting misconfigurations.
• Procedures reveal distinct, real-world implementations used by specific threat groups.

Multiple techniques are associated with each tactic, and MITRE provides granular documentation for every technique, including:

• Overview and description
• Associated sub-techniques
• Examples of related real-world procedures
• Mitigations for countering the technique
• Detection methods and data sources
• Related technical metadata

Combined, these TTPs provide a standardized vocabulary for security teams to discuss attacks and orchestrate threat intelligence mapping across enterprise, mobile, and ICS domains.

The Cloud Matrix is a dedicated subset of the Enterprise Matrix focused on cloud-specific threats and adversaries. It helps organizations assess cloud risk, build defensive strategies, and select security tools across Azure Active Directory, Microsoft 365, Google Workspace, SaaS, and major IaaS providers including AWS, Azure, and GCP.

Because cloud adversaries follow a unique playbook that bypasses traditional hardware and network boundaries, the scope and order of tactics in the Cloud Matrix differ from the broader Enterprise Matrix:

The underlying techniques within these tactics also vary significantly between on-premises enterprise networks and cloud environments:

• Persistence: While traditional persistence involves installing backdoors to maintain long-term network access, cloud persistence tactics include adding credentials to a cloud account or implanting malicious containers in a PaaS deployment.
• Defense Evasion: In a traditional enterprise environment, adversaries may clear shell history and logs or manipulate tokens. A cloud adversary, by contrast, might abuse cloud administrator capabilities for short-term privilege access, disable cloud firewalls, or manipulate cloud workloads.
• Exfiltration: Stealing data from an on-premises network typically requires encrypting, compressing, and moving files over command-and-control (C2) channels. In cloud environments, adversaries often exfiltrate data simply by transferring it to an external cloud storage bucket.

The MITRE ATT&CK framework offers more than a catalog of attacker behaviors; it drives continuous monitoring and proactive vigilance. Because threats evolve rapidly, knowing how an attacker will attempt to infiltrate or pivot within your environment helps focus detection on high-probability vulnerabilities.

Armed with a comprehensive map of TTPs, teams can implement external attack surface management to ensure every public-facing system or application is examined for entry points. Furthermore, because the framework captures both common and novel techniques, analysts can classify suspicious activity rapidly—whether adversaries launch campaigns via phishing, malware injection, or zero day exploits.

Key Benefits of Using MITRE ATT&CK

• Enhanced threat detection: Mapping adversary actions to documented techniques helps security teams identify malicious behavior and optimize incident response faster.
• Prioritized security investments: Aligning defenses with real-world TTPs guides organizations on where to allocate budget and resources most effectively.
• Improved collaboration: Sharing a common language across internal teams and industry partners eliminates confusion and accelerates coordinated response.
• Informed patch management: Leveraging intelligence on commonly exploited flaws reduces the risk of successful attacks.

According to MITRE and industry best practices, organizations rely on ATT&CK across several high-impact operational use cases:

• Threat detection, analytics, and incident response: The matrix helps security teams build analytics that detect adversary techniques and prioritize containment actions. Defenders can visit the MITRE Cyber Analytics Repository to access community-written detection analytics.
• Threat intelligence integration: MITRE ATT&CK provides a structured taxonomy to organize, compare, and analyze internal and external threat data, allowing teams to track the behaviors of known threat groups and respond to emerging attack patterns.
• Attack emulation, red teaming, and BAS: Red teams use ATT&CK as a blueprint for realistic penetration testing and vulnerability assessments—often leveraging Atomic Red Team™, an open-source library of tests mapped directly to the framework. Similarly, teams use ATT&CK data on threat actors and their favored targets to run automated breach and attack simulations (BAS).
• Security control assessment and engineering: Mapping existing detection and mitigation capabilities onto the matrix exposes coverage gaps, helping engineers evaluate tools and pinpoint high-priority areas for security investment.
• Countering insider threats: MITRE ATT&CK catalogs critical data sources—such as application authentication logs—that help analysts determine whether a threat actor is operating internally or externally.

While both frameworks address cyberattacks, MITRE ATT&CK and the Cyber Kill Chain (developed by Lockheed Martin in 2011 based on military models) differ fundamentally in how they model threats:

While invaluable, the MITRE ATT&CK framework is not a standalone cure-all. Adopting it effectively requires planning around its constraints:

• Complex implementation: Mapping an entire enterprise environment to the framework can be time-intensive for teams with limited staff.
• Continuous maintenance: Because adversaries constantly evolve their TTPs, framework mappings must be updated and personnel trained regularly.
• Potential overemphasis on known threats: Novel, zero-day exploit strategies may not always align neatly with preexisting classifications.
• Resource constraints: Collecting and normalizing the telemetry needed for comprehensive mapping can strain smaller security budgets.
• Contextual gaps: While TTPs explain how an attack occurred, they do not always clarify the broader business impact or adversary motivation.

To make MITRE ATT&CK a meaningful operational asset rather than a compliance checkbox, follow a structured five-step adoption roadmap:

1. Assess your current security posture: Review existing processes, tools, and telemetry to identify visibility gaps where the framework can deliver immediate value.
2. Map known threats to ATT&CK: Analyze past incidents and map observed adversary behaviors to recognized TTPs to see which attack vectors succeed most frequently in your environment.
3. Configure monitoring and alerts: Tune threat detection rules across network traffic and endpoint telemetry to trigger timely alerts aligned with ATT&CK techniques.
4. Provide organization-wide training: Share framework workflows beyond the SOC—including teams responsible for compliance, access control, and IT operations—to establish a unified security vocabulary.
5. Iterate and update: Continuously update your mappings as new threats emerge, MITRE releases biannual updates, or your cloud architecture evolves.

As organizations embrace cloud ecosystems and hybrid work, zero trust architectures have become essential for protecting data across on-premises servers, cloud workloads, and SaaS applications. The MITRE ATT&CK framework dovetails naturally with zero trust by providing a granular breakdown of post-compromise attacker behavior, making it easier to enforce precise, identity-driven security controls.

In a zero trust model, blocking unauthorized users at the network perimeter is no longer sufficient; every request from every user, endpoint, and account must be continuously verified. By integrating ATT&CK TTPs into zero trust policies, security teams can detect and halt methodologies like lateral movement or privileged access abuse before they escalate. Continuous monitoring through the MITRE ATT&CK lens bridges the gap between identity verification, device posture, and inline inspection.

Zscaler Cloud Sandbox maps directly to the MITRE ATT&CK framework by detecting and analyzing evasive malware techniques across every stage of the attack chain. From initial access (such as spear phishing attachments) to execution (malicious file behaviors) and command-and-control (beaconing activity), Zscaler observes and maps behaviors directly to ATT&CK techniques—enabling faster, threat-informed detection and response so you can:

• Prevent zero-day threats in seconds: Stop unknown file-based threats inline with advanced threat detection and AI-driven instant verdicts.
• Bolster security and preserve productivity: Automatically detect and quarantine threats without slowing users down by integrating Zero Trust Browser Isolation with cloud sandbox capabilities.
• Optimize SOC workflows: Seamlessly enrich SOC investigations with out-of-band file analysis, third-party threat intelligence integrations, and automated malware analysis across both unpatched and fully patched VMs.
• Deploy easily and scale globally: Eliminate the cost and complexity of legacy hardware with cloud-native policy configurations that deliver immediate protection and strong ROI.

Ready to see how Zscaler can map your defenses to the threats that matter most? Request a demo.