TTP: Tactics, Techniques, and Procedures in Cybersecurity
TTP stands for Tactics, Techniques, and Procedures. TTPs describe the behavior patterns of threat actors, from high-level goals (tactics) to specific methods (techniques) and detailed implementation steps (procedures). The MITRE ATT&CK framework organizes known adversary TTPs into a structured knowledge base.
How TTP Is Used in Cybersecurity
Threat intelligence analysts map adversary TTPs to MITRE ATT&CK to profile threat groups and predict their next moves. SOC teams build detection rules that target specific techniques rather than relying solely on IOC signatures. Incident responders use TTP analysis to attribute attacks and understand the full scope of an intrusion.
Read the full glossary entry: Tactics, Techniques, and Procedures in Cybersecurity
Cybersecurity Roles That Work with TTP
Related Cybersecurity Acronyms
Frequently asked questions
What does TTP stand for?
TTP stands for Tactics, Techniques, and Procedures. TTPs describe the behavior patterns of threat actors, from high-level goals (tactics) to specific methods (techniques) and detailed implementation steps (procedures). The MITRE ATT&CK framework organizes known adversary TTPs into a structured knowledge base.
What is TTP used for in cybersecurity?
Threat intelligence analysts map adversary TTPs to MITRE ATT&CK to profile threat groups and predict their next moves. SOC teams build detection rules that target specific techniques rather than relying solely on IOC signatures. Incident responders use TTP analysis to attribute attacks and understand the full scope of an intrusion.
Where to go next
Three next steps depending on where you are. The first two are free.
Free · 2 minutes
Start with the AI Risk Score
Two minutes. Tells you how exposed your current role is to AI automation and which defensive moves carry the best return.
Start the AI Risk Score →Paid program · $147-$597
Aligned course: Career Transition
Capstone reviewed by the founder, published rubric, Ed25519-signed verifiable credential on completion.
View the course →Free account
Save your results and track progress
A free account stores your assessments, recommendations, and an exportable copy of your Career DNA. No card needed.
Create your account →Definitions are original explanations written for career development purposes. For authoritative technical definitions, refer to NIST, ISO, or the relevant standards body.