What is MITRE ATT&CK in Cybersecurity?
MITRE is 'MY-ter' (rhymes with 'fighter'). ATT&CK is pronounced 'attack'.
A globally accessible knowledge base of adversary tactics, techniques, and procedures based on real-world observations. ATT&CK catalogs how attackers operate across the full attack lifecycle, from initial access through exfiltration. Security teams use it to assess detection coverage, build threat models, and communicate about adversary behavior.
Why MITRE ATT&CK Matters for Your Cybersecurity Career
MITRE ATT&CK has become the standard language for cybersecurity threat discussions. SOC analysts map detection rules to ATT&CK technique IDs. Threat intelligence analysts use ATT&CK to profile threat groups. Security engineers assess their detection coverage against the ATT&CK matrix. Familiarity with ATT&CK is expected in job interviews for almost every cybersecurity defense role.
Which Cybersecurity Roles Use MITRE ATT&CK?
Related Cybersecurity Terms
Related Cybersecurity Certifications
Citation index · auto-derived from course content
Where MITRE ATT&CK is used across DecipherU
12 public surfaces on the platform reference this term in a meaningful way. Sorted by relevance.
Courses · 6
Lessons that teach this term as part of a structured curriculum.
"The MITRE ATT&CK framework as the working vocabulary of the modern SOC, the…"
"…and does not capture Read a cloud-attack technique on the MITRE ATT&CK Cloud matrix and translate it into a detection query agains…"
"…etitor release notes. Read earnings calls. Subscribe to the MITRE ATT&CK update feed. The rep who sees the tide turning six months b…"
"…break the chain at any earlier stage rather than the last. MITRE ATT&CK extends the Kill Chain by cataloging specific adversary tec…"
"Generate hunt hypotheses from MITRE ATT&CK technique IDs and your SIEM's data inventory using a struct…"
"…e. That means a timeline, an attack-chain diagram mapped to MITRE ATT&CK, a list of indicators of compromise, and a recommendation b…"
Related glossary entries · 6
Other glossary terms whose definition cites this one.
"…ors. Threat intelligence analysts map adversary TTPs to the MITRE ATT&CK framework. SOC analysts write detection rules targeting spe…"
"…ules in languages like Sigma, KQL, and SPL, map coverage to MITRE ATT&CK techniques, and measure detection effectiveness through met…"
"…that uses knowledge of actual adversary behavior (TTPs from MITRE ATT&CK, threat intelligence, and incident data) to prioritize defe…"
"…ity engineers use BAS to measure detection coverage against MITRE ATT&CK techniques. SOC analysts validate that their detection rule…"
"…latforms execute safe versions of real attack TTPs from the MITRE ATT&CK framework and report which controls detected, blocked, or m…"
"…cific query languages (SPL, KQL, YARA-L), map detections to MITRE ATT&CK techniques, tune queries for performance, and reduce false…"
A globally accessible knowledge base of adversary tactics, techniques, and procedures based on real-world observations. ATT&CK catalogs how attackers operate across the full attack lifecycle, from initial access through exfiltration. Security teams use it to assess detection coverage, build threat models, and communicate about adversary behavior.
MITRE ATT&CK has become the standard language for cybersecurity threat discussions. SOC analysts map detection rules to ATT&CK technique IDs. Threat intelligence analysts use ATT&CK to profile threat groups. Security engineers assess their detection coverage against the ATT&CK matrix. Familiarity with ATT&CK is expected in job interviews for almost every cybersecurity defense role.
Cybersecurity professionals who work with MITRE ATT&CK include SOC Analyst, Threat Intelligence Analyst, Security Engineer. These roles apply MITRE ATT&CK knowledge within the Defensive Security domain.
Sources
Definitions are original explanations written for career development purposes. For authoritative technical definitions, refer to NIST, ISO, or the relevant standards body.
This role lives inside a packaged path
Want the curriculum, comp delta, and recommended courses for this role?
DecipherU bundles cybersecurity roles into a small set of packaged paths. Each path has the curriculum sequence, the compensation delta it unlocks, and the recommended courses, all pre-set. Two ways in:
Related Resources
Related Cybersecurity Career Guides
Related Cybersecurity Certifications
Was this page helpful?
Where to go next
Three next steps depending on where you are. The first two are free.
Free · 2 minutes
Start with the AI Risk Score
Two minutes. Tells you how exposed your current role is to AI automation and which defensive moves carry the best return.
Start the AI Risk Score →Paid program · $147-$597
Aligned course: Career Transition
Capstone reviewed by the founder, published rubric, Ed25519-signed verifiable credential on completion.
View the course →Free account
Save your results and track progress
A free account stores your assessments, recommendations, and an exportable copy of your Career DNA. No card needed.
Create your account →