Foundations 8 min read

MITRE ATT&CK Fundamentals

Tactics vs. techniques, how the matrix is organized, and why mapping to ATT&CK turns 'we ran some tests' into a coverage number you can track.

All tactics

MITRE ATT&CK is a knowledge base of how real adversaries behave, distilled from observed intrusions. It gives every step of an attack a shared name and id so teams can talk about detection in the same language.

Tactics vs. techniques

A tactic is the adversary's goal for a step, Initial Access, Execution, Impact. A technique is a concrete way to achieve it. Techniques carry a T-code (T1566) and often a sub-technique (T1566.001, Spearphishing Attachment).

There are 14 enterprise tactics. Reading them left to right approximates a modern kill chain: get in, run code, escalate, steal credentials, move laterally, and cause impact.

Why mapping matters

Firing a pile of atomic tests tells you little. Mapping each action, and each detection that did or didn't fire, to an ATT&CK id turns an exercise into a coverage map: detected, partial, or missed, per technique. That is a number you can improve and defend to leadership.

In Tyrian, every scenario stage declares its ATT&CK techniques, and the range scores your detections against them automatically, then exports a MITRE ATT&CK Navigator layer you can hand to an auditor.

Stop reading. Start detecting.

Try the interactive kill chain in your browser, no signup, then run the real range.

Run it live, free

Next module

What Is Purple Teaming?

→