# What Is MITRE ATT&CK?

> MITRE ATT&CK is a public knowledge base of adversary tactics and techniques observed in real attacks, organised into a matrix. It gives defenders a shared vocabulary (technique IDs like T1059) for describing how an actor operates, from initial access to exfiltration.

*Source: https://www.whisper.security/glossary/mitre-attack*
*Last updated: 2026-09-27*

---

## Tactics, techniques, and the matrix

ATT&CK organises adversary behaviour into tactics (the why — the attacker's goal at a stage, like Persistence or Exfiltration) and techniques (the how — the specific method used to achieve it). Each technique has a stable ID, so two analysts on opposite sides of the world can describe the same behaviour the same way.

## Why a shared vocabulary helps

Before ATT&CK, every vendor described attacks differently. A shared catalogue means detections, threat reports, and red-team plans all map to the same reference, so coverage gaps become visible and intelligence becomes comparable across sources.

## From technique to infrastructure

ATT&CK tells you how an actor operates; it does not, by itself, tell you where. The value comes from joining a named actor's techniques to the live infrastructure it uses — turning a behavioural profile into concrete hunting leads.

## Where this shows up

See it in a live investigation: [Map a named actor to its ATT&CK techniques](/products/intelligence/use-cases/threat-investigation/indicator).

Go hands-on with [the threat-intel recipes](/docs/recipes/threat-intel).