Glossary
MITRE ATT&CK
MITRE ATT&CK is a public framework that organises what attackers do into tactics and techniques.
What it means
MITRE ATT&CK is a public framework that organises what attackers do into tactics and techniques. A tactic is the goal — for example, getting in, or staying hidden. A technique is the specific way an attacker achieves that goal — for example, a phishing email, or a stolen password. The framework gives every technique a name and an ID, so security teams around the world can talk about the same behaviour in the same words. It is the shared vocabulary of the security field.
How it works
ATT&CK is organised into matrices for enterprise, mobile and industrial systems, and each matrix is a grid of tactics across the top and techniques beneath them. A technique can belong to more than one tactic, and each technique has sub-techniques for the variations. Security teams use the framework to map what they observed in an incident — which techniques were used, in which order — and to find the gaps: the techniques their defences would not have caught. It is descriptive, not prescriptive: it records what attackers do, and it does not tell you how to do it. The MITRE ATT&CK explorer tool on this site is a static, client-side map for beginners: pick a tactic, see its techniques in plain English, and learn what evidence a security team would look for. MITRE ATT&CK is a registered trademark of The MITRE Corporation, and this site uses it with attribution and no implication of affiliation.
Example
Imagine a fictional security team investigating a breach. The news says the attack was sophisticated, which tells them nothing. The team's incident report says something concrete instead: initial access through a phishing email, persistence through a scheduled task, credential access through a stolen password, and exfiltration over an encrypted channel. Each of those is an ATT&CK technique, and writing the incident in those terms lets the team compare it with past incidents, check which of their defences should have caught each step, and explain the attack to management in language that is precise rather than alarming. That is what the framework is for.
Common misunderstandings
The most common misunderstanding is that ATT&CK is a manual for attackers. It is not: it describes behaviour at a level that helps defenders recognise and name it, without the detail that would let someone carry it out. The second misunderstanding is that covering every technique in the framework is the goal. It is not — no organisation can defend everything at once, and the framework is used to prioritise the techniques that matter most against the threats that organisation actually faces.
Related terms
Learn more
- MITRE ATT&CK explained
- What is a CVE ID?
- Learn OSINT from scratch
- Threat Intelligence Introduction
- Back to the full glossary
Last checked: 14 November 2026.
Frequently asked questions
Is MITRE ATT&CK free to use?
Yes — MITRE ATT&CK is free to use at no charge. MITRE ATT&CK is a registered trademark of The MITRE Corporation, and this site uses the name with attribution and no implication of affiliation or endorsement.
What is the difference between a tactic and a technique?
A tactic is the attacker's goal — getting in, staying hidden, stealing data. A technique is the specific way the goal is achieved — a phishing email, a stolen password, a scheduled task. The tactic is the why; the technique is the how.
Do I need to memorise the whole framework?
No. Even professionals do not memorise it — they use it as a reference and a map. The value for a beginner is the structure: knowing that attacker behaviour can be named tactic by tactic, technique by technique, instead of described as a vague sophisticated attack.