MITRE ATT&CK, plainly: tactics, technique IDs and a cheat card for each tactic

Wed, 21 Oct 2026 19:30:00 -0400

A football coach studies match footage of the other team: how they open, how they press, how they score. MITRE ATT&CK is the match footage of real attackers, cut into named and numbered moves.

The OWASP Top 10 describes weaknesses in your software. ATT&CK describes what attackers do: how they get in, stay in, move around and take what they came for. You will see its IDs, such as T1190 or T1552.001, in threat reports, detection rules and, increasingly, in pipeline designs like the one in my SSDLC post. This post explains how to read them.

Attack on Samarthya

MITRE ATT&CK, plainly: tactics, technique IDs and a cheat card for each tactic