How MITRE ATT&CK works
ATT&CK organizes attacker behaviour in a matrix. Columns are tactics, the goals an attacker pursues such as initial access, persistence, privilege escalation, lateral movement and exfiltration. Within each tactic are techniques and sub-techniques describing how the goal is achieved, with examples and mitigations.
The framework also profiles known threat groups and software, listing which techniques each has been observed using. Defenders map their detection rules and logs to technique identifiers, which makes it possible to see which behaviours are monitored and which are blind spots. Navigator-style heat maps make coverage easy to share with leadership.
Why it matters for Canadian organizations
ATT&CK gives Canadian security teams a vendor-neutral way to describe threats and prove detection coverage. That matters when reporting to boards, auditors or regulators, including federally regulated institutions working toward OSFI B-13 expectations on threat detection and testing.
It also helps prioritize limited budgets. By focusing on techniques used by ransomware operators and state-linked groups that target Canadian sectors, an organization can invest in the detections and controls that address the most relevant attacker behaviour. Publish the results as simple coverage charts so executives can follow progress without reading technical detail.
How to implement it
Start by mapping existing detections, such as SIEM rules and EDR alerts, to ATT&CK technique IDs and visualize the gaps. Rank techniques by relevance to your industry and threat intelligence, then write or tune detections for the highest-priority gaps first.
Use the same mapping for testing. Penetration tests, red team engagements and purple team exercises can emulate specific techniques, allowing you to confirm whether each one is blocked, logged and alerted on, and to track improvement over time. Revisit mappings after each test so improvements are visible rather than assumed.
Frequently asked questions
Is MITRE ATT&CK a compliance framework?
No. ATT&CK is a descriptive knowledge base of attacker behaviour, not a set of requirements to certify against. It supports compliance work indirectly by helping show how controls and detections address realistic threats. It informs decisions but never certifies anything.
What is the difference between ATT&CK and the Cyber Kill Chain?
The Cyber Kill Chain describes a linear sequence of attack stages. ATT&CK is more granular, listing many specific techniques under each tactic, and does not assume attacks proceed in a fixed order. ATT&CK is also more detailed and does not assume attacks follow a fixed sequence.
Is MITRE ATT&CK free to use?
Yes. MITRE publishes ATT&CK openly, and organizations can use it at no cost for detection engineering, testing, training and reporting, subject to the terms MITRE provides on its website. Many vendors build their detections and reports around it.
Related service: Cyber defense