Key Facts
- Regulator
- The MITRE Corporation (publisher of MITRE ATT&CK; not a regulator)
- Latest version
- ATT&CK v20 (v20.0), the October 2026 release, covering Enterprise, Mobile and ICS
- Effective
- 13 October 2026
- Official text
- attack.mitre.org ↗
What is MITRE ATT&CK?
MITRE ATT&CK is a free, openly available knowledge base of adversary behaviour, published by The MITRE Corporation. It catalogues the tactics and techniques attackers use across the attack lifecycle in enterprise IT, cloud, mobile and industrial control systems. Any organisation can use it, and it suits security, threat-intelligence and risk teams in every sector.
The current release is ATT&CK v20 (v20.0), dated 13 October 2026 on MITRE's updates page, covering Enterprise, Mobile and ICS.
MITRE began the MITRE ATT&CK framework in 2013 to document the tactics, techniques and procedures (TTPs) that advanced persistent threats use against Windows enterprise networks. Coverage is now much wider: Windows, macOS, Linux, network infrastructure devices and containers, plus cloud systems and mobile devices. The MITRE ATT&CK FAQ is the publisher's own account.
Why it matters
A threat model that says "an attacker might get in" gives nobody anything to test. MITRE ATT&CK names the behaviours, so the question becomes which of them your controls would catch.
A technique list is not a risk assessment.
The UK NCSC's threat-modelling guidance names ATT&CK as useful for understanding how threat actors carry out attacks against particular technology types and platforms in the real world. It adds that ATT&CK suggests mitigations for the techniques you identify.
That answers what MITRE ATT&CK is used for, and it comes down to three jobs:
- Analysing how a system might be attacked, using a structured set of techniques rather than a blank page.
- Proposing controls once threats are identified, drawing on the mitigations ATT&CK lists.
- Feeding risk management. The NCSC says the resulting controls should be weighed against your risk appetite and recorded in risk treatment and assurance plans.
Who it applies to
MITRE ATT&CK is voluntary: no regulation requires it. MITRE says it is open and available to any person or organisation at no charge. It applies to every industry and organisation size, but it is most useful to people who analyse threats, design detection or run risk assessments.
ISO 27001 is a management system standard that you run and have assessed. MITRE ATT&CK is a knowledge base, so it does not replace it. It sits underneath, giving the threat side of your risk assessment a common vocabulary. The nearest Annex A control is A.5.7 Threat intelligence; for the management system itself, see the ISO 27001 vault.
The UK position
No UK law requires MITRE ATT&CK. A UK firm meets it through guidance: the NCSC recommends threat modelling during design and development and cites ATT&CK's technique groupings as one structured way to describe attacks. That is guidance, not a legal requirement.
None of the UK or EU regimes we checked mandates it. If a customer or tender names ATT&CK, treat it as a contractual ask, not a legal one.
Key requirements
MITRE ATT&CK sets no requirements for you to meet. What it gives you is a structure, and the structure is what to learn:
- Tactics are the adversary's goal, the "why".
- Techniques are how the goal is achieved, the "how". Sub-techniques describe them more specifically.
- Procedures are specific implementations seen in the wild. They appear in the "Procedure Examples" section of each technique page.
- Supporting objects sit alongside: groups, software, campaigns and mitigations, plus detection strategies, analytics and data components.
An intrusion does not have to walk the matrix from left to right.
The MITRE ATT&CK matrix
The Enterprise matrix lists tactics from Reconnaissance to Impact. It is published per platform, including Windows, macOS, Linux, cloud platforms, network devices, containers and ESXi.
In v20 the Enterprise domain holds 15 tactics, 227 techniques and 479 sub-techniques. It also holds 178 groups, 842 pieces of software, 57 campaigns and 44 mitigations. Mobile and ICS have their own matrices.
How it sits beside other models
MITRE says most models and frameworks are complementary to ATT&CK, so you do not have to choose one. ATT&CK documents detailed adversary behaviour, while the Diamond Model helps you cluster intrusions. Techniques mapped to ATT&CK can feed a Diamond Model analysis of what an adversary is capable of.
Frequently asked questions
MITRE ATT&CK is The MITRE Corporation's catalogue of how real attackers behave. It began as the shared language for MITRE's FMX research project, which tested whether endpoint sensors and analytics caught attackers already inside a network. It gave attack and defence teams a common language they could both use to improve over time.
The use of MITRE ATT&CK is to describe, test and compare attacker behaviour in a shared structure, including inside commercial products and services. MITRE allows that at no charge under its Terms of Use. It forbids using the MITRE ATT&CK name in a way that implies MITRE endorses a product or service. A tool that claims ATT&CK coverage is making its own claim, not MITRE's.
MITRE ATT&CK v20 lists 15 tactics, 227 techniques and 479 sub-techniques for Enterprise. Mobile has 12 tactics, 78 techniques and 47 sub-techniques, and ICS has 12 tactics, 78 techniques and 26 sub-techniques. Across all three domains the release holds 971 pieces of software, 182 groups and 61 campaigns. The counts change with every major release.
ATT&CK v20.0, released on 13 October 2026, is the current version of MITRE ATT&CK. Since April 2021 MITRE has published a new major version each April and October; minor versions correct typos and data. MITRE keeps a permalink to every past version's website, so a mapping built on an older release, such as v16.1, can still be checked.
Lockheed Martin's Cyber Kill Chain describes an attack's high-level objectives as ordered phases. MITRE ATT&CK sits at a lower level, describing the specific behaviour behind each step, and MITRE says the two are complementary. ATT&CK tactics are unordered and may not all occur in one intrusion, because an attacker's goals change during an operation.