MITRE ATT&CK, plainly: tactics, technique IDs and a cheat card for each tactic

The OWASP Top 10 describes weaknesses in your software. ATT&CK describes what attackers do: how they get in, stay in, move around and take what they came for. You will see its IDs, such as T1190 or T1552.001, in threat reports, detection rules and, increasingly, in pipeline designs like the one in my SSDLC post. This post explains how to read them.

What it is

#

MITRE’s own definition is short: ATT&CK is a “knowledge base of adversarial techniques based on real-world observations” (ATT&CK resources). It is free to use, and every entry links to the public reports it was built from.

There are three matrices: Enterprise (Windows, Linux, macOS, cloud, containers, network devices), Mobile and ICS (industrial control systems). This post covers Enterprise.

The current release is ATT&CK v20, from 13 October 2026. Its Enterprise matrix has 15 tactics, 227 techniques and 479 sub-techniques (ATT&CK updates).

How to read an ID

#

ATT&CK has a small vocabulary. MITRE puts it this way: tactics are the why, techniques are the how.

So T1552.001 reads as: technique 1552, Unsecured Credentials, sub-technique 001, Credentials In Files (T1552.001). It falls under the Credential Access tactic, and MITRE lists mitigations such as auditing for password files (M1047) and password policies that forbid storing them (M1027). That is a leaked .env file in a repository, described in a way every security tool understands.

One technique can serve several tactics. T1078 Valid Accounts, logging in with stolen but real credentials, is listed under Initial Access, Persistence, Privilege Escalation and Stealth, because a real account helps with all four.

What changed recently: Defense Evasion was split

#

If you learned ATT&CK a few years ago, you will remember 14 tactics, including Defense Evasion. That tactic is gone. In its place are two (Sophos):

• Stealth (TA0005, the old ID): “The adversary is trying to hide and conceal their actions, appearing as normal behavior”, for example Masquerading (T1036) or Obfuscated Files or Information (T1027) (TA0005).
• Defense Impairment (TA0112, new, created in April 2026): “The adversary is trying to break security mechanisms, pipelines, and tooling so defenders can’t see or trust what’s happening”, for example Disable or Modify Tools (T1685) (TA0112).

The difference is useful: hiding from your defences versus breaking them. Note the word “pipelines” in the new tactic. Tampering with a CI system’s security checks is now a named attacker goal. Older reports and tools still use Defense Evasion; map them to one of the two.

The cheat cards: 15 tactics

#

One card per tactic, in the order an attack usually unfolds. Each has the tactic ID, its goal in plain words, one example technique and what a development team can do about it. The colours group the phases: blue for getting in, orange for gaining a foothold, purple for spreading, red for the payoff.

How a developer uses it

#

ATT&CK was built for defenders and threat hunters, but it is useful one step earlier, in the pipeline.

1. Name what each control stops. “Gitleaks on commit” is a tool. “Gitleaks on commit stops T1552.001” is a reason. The SSDLC post tags every pipeline level this way:

   Pipeline level	Technique it guards against	MITRE mitigation
   Commit: secret scanning	T1552.001 Credentials In Files	M1047 Audit
   PR and build: dependency scanning	T1195.001 Compromise Software Dependencies and Development Tools	M1016 Vulnerability Scanning
   Build: signed provenance	T1195.002 Compromise Software Supply Chain	M1013 Application Developer Guidance
   Nightly rescan of exposed apps	T1190 Exploit Public-Facing Application	M1051 Update Software

   Techniques from T1195 and T1190; mitigations as MITRE lists them.

2. Find the gaps. Shade the techniques you cover in the free ATT&CK Navigator. The white areas are the conversation for your next planning meeting.

3. Speak the same language as the security team. A finding tagged with an OWASP category (the weakness) and an ATT&CK technique (the attack) is understood by developers and by the people who write detections.

What it does not do

#

• It does not rank anything. ATT&CK does not say which technique is most dangerous for you. Use exposure, KEV and EPSS for that, as in part 4 of the standards series.
• It is not a checklist to complete. Hundreds of techniques, many irrelevant to a given system. Pick the ones your architecture makes possible.
• IDs change. Techniques get added, moved and occasionally replaced; in 2026 even a tactic was split. Note the version when you tag findings.

Takeaways

#

• ATT&CK is match footage of real attackers: tactics are the why (TA…), techniques the how (T…), sub-techniques the exact how (T….001).
• v20 (13 October 2026): 15 Enterprise tactics, 227 techniques, 479 sub-techniques. Defense Evasion became Stealth and Defense Impairment.
• For developers, the value is naming what each control stops and spotting what nothing stops.
• OWASP Top 10 describes the weakness; ATT&CK describes the attack. Use both.

References

#

• MITRE ATT&CK: MITRE, the three matrices and the Enterprise tactic list with IDs
• ATT&CK updates: MITRE, v20 release date (13 October 2026) and Enterprise counts
• ATT&CK resources: MITRE, the definition, tactics as “why” and techniques as “how”, ATT&CK Navigator
• TA0005 Stealth and TA0112 Defense Impairment: MITRE, descriptions, creation date, example techniques
• T1552.001 Credentials In Files: MITRE, description and mitigations M1047, M1027
• T1195 Supply Chain Compromise: MITRE, sub-techniques .001 to .003 and mitigations
• T1190 Exploit Public-Facing Application: MITRE, tactic, description, mitigations M1051, M1035, M1030, M1050
• Technique pages used for the cheat cards: T1595, T1583, T1059, T1053, T1068, T1036, T1685, T1082, T1021, T1213, T1071, T1041, T1486, T1078: MITRE, names and tactics as of v20
• MITRE Enterprise ATT&CK grew a 15th tactic: Sophos, that Stealth and Defense Impairment replaced Defense Evasion