MITRE ATT&CK is a free, public knowledge base of attacker behavior, built from observation of real intrusions. It is maintained by MITRE, a not for profit organization, and it has become the common language of the industry.
Before it existed, two teams describing the same intrusion would use completely different words. Now they use technique identifiers, and everyone knows what is meant.
Tactics, Techniques, and Procedures
A tactic is the attacker's goal at a stage: initial access, execution, persistence, privilege escalation, defense evasion, credential access, discovery, lateral movement, collection, command and control, exfiltration, and impact. Those are the columns of the matrix.
A technique is how they achieve it. Phishing is a technique under initial access. Techniques have identifiers such as T1566, and many have sub techniques for specific variants.
A procedure is the specific implementation a particular group used. Same technique, different tooling and details.
There are separate matrices for enterprise, mobile, and industrial control systems, and the whole thing is at attack.mitre.org.
How It Is Different From the Kill Chain
The Lockheed Martin Cyber Kill Chain describes an intrusion as a linear sequence of seven stages. It is a good teaching model and it is why people talk about breaking the chain.
ATT&CK is not linear. Real intrusions loop, skip stages, and run several at once. An attacker may escalate privileges, move laterally, escalate again, and collect data in an order that no clean diagram captures.
Both are useful. The kill chain is better for explaining an intrusion to an executive. ATT&CK is better for doing the work.
Using It for Detection Coverage
The common use is mapping your detections to techniques and looking at the gaps. The free ATT&CK Navigator makes the heat map everyone has seen in a slide deck.
The mistake is treating coverage as a percentage to maximize. Techniques are not equally likely, equally damaging, or equally detectable in your environment, and a rule that technically touches a technique is not the same as reliable detection of it.
A green square should mean you have tested that detection and watched it fire. Until then it means you wrote something. That is why detection engineering insists on validation.
Using It for Threat Intelligence
Most published threat reporting now maps behavior to ATT&CK techniques. That turns a narrative report into something actionable: a list of techniques you can check your own coverage against.
ATT&CK also tracks groups and software, so you can look up a named group and see the techniques attributed to it. This is what makes adversary emulation practical, and MITRE publishes emulation plans for specific groups.
Treat group attribution with the usual caution. Naming is inconsistent across vendors and attribution is genuinely hard, so the techniques are more useful to you than the name.
Using It for Communication
The underrated use. Writing an incident report against techniques makes it readable by anyone in the industry, and makes your findings comparable across time.
It also makes gaps arguable in budget terms. Saying we have no detection capability for credential dumping is a much stronger case than saying we should invest in endpoint security.
What ATT&CK Is Not
It is not a maturity model, and there is no score. It is not a list of what will happen to you, only of what has been observed somewhere.
It is not exhaustive, and it lags. Techniques appear after they have been seen and documented, so a matrix cannot tell you about something new.
And it is descriptive rather than prescriptive. For the defensive counterpart, MITRE also publishes D3FEND, which catalogs defensive techniques, and ATLAS, which does the same job for attacks on AI systems.
A Practical Way to Start
Pick five techniques that are common and relevant to your environment. Work out which log source would show each one. Check whether you actually collect it. Write a detection. Test it by running the behavior.
That produces five squares you can genuinely trust, which is worth more than a hundred you cannot. It is also exactly the exercise in Week 10 of the mentorship.
Learn This at HackRange
ATT&CK runs through the whole second half of the mentorship, from reading an intrusion in Week 9 to validating detections in Week 10.