Also known as: ATT&CK · ATT&CK framework · TTPs
MITRE ATT&CK is a public knowledge base that catalogues real-world adversary tactics, techniques, and procedures, organised into a matrix that maps how attackers progress through an intrusion.
ATT&CK gives the industry a shared vocabulary. Rather than describing an intrusion in prose, teams can reference specific technique identifiers, making detection coverage, threat intelligence, and red team findings directly comparable.
Its most common practical use is gap analysis: mapping existing detections onto the matrix reveals which techniques would currently go unnoticed. The main pitfall is treating full matrix coverage as the goal — techniques are not equally likely, and chasing complete coverage misallocates effort.
Threat Hunting
Threat hunting is the proactive search for attackers already present in an environment, driven by hypotheses about adversary behaviour rather than by alerts from automated detection tools.
Indicator of Compromise
An indicator of compromise (IOC) is an observable artifact — such as a file hash, IP address, domain, or registry key — that suggests a system may have been breached.
Incident Response
Incident response is the structured process an organisation follows to detect, contain, eradicate, and recover from a security incident, and to learn from it afterwards.
Red Team
A red team is a group that simulates realistic adversary behaviour against an organisation to test not just its technical defences but its ability to detect and respond to an intrusion in progress.
SIEM
A SIEM (Security Information and Event Management) system centralises log and event data from across an organisation's infrastructure, correlating it to detect suspicious activity and support investigation.