MITRE ATT&CK

What Is MITRE ATT&CK Used For in Vendor Risk Programs?

The framework separates why an attacker acts from how they act. 

• A tactic is the objective, such as initial access or privilege escalation. 
• A technique is the method used to reach that objective. 
• A procedure is the specific implementation a named group used, down to the tooling and infrastructure it relied on. 

MITRE builds the model from confirmed intrusions and keeps adding to it as new attacker behavior gets documented in the field.

Most security teams use ATT&CK to give attacker behavior a shared name. Before the framework existed, one analyst's "lateral movement" was another analyst's "pivoting," and two reports about the same intrusion could read like they described different incidents. ATT&CK fixes that by giving every stage of an attack a consistent label any team can reference.

Threat Hunters Simulate Confirmed Attacker Behavior

A hunt team can pull a specific group's documented technique list and test whether those exact behaviors would succeed in their own environment, replacing guesswork about generic attack patterns that don't match anything currently active.

Detection Engineers Map Coverage Against Techniques

Mapping existing alerts against the technique list shows which stages of a real attack a security stack would actually catch, and which ones it would let through without ever firing a warning.

Vendor Risk Teams Judge Exposure Relevance

A vulnerability count alone doesn't say whether a vendor is a meaningful target. Comparing a vendor's exposure against a specific threat actor's known techniques turns a generic risk score, built on standards-based ratings, into a specific, actionable warning about who is likely to come after that vendor next. Black Kite's cyber risk intelligence platform flags vendors affected by actively exploited vulnerabilities and live cyber events through FocusTags®, while the Adversary Susceptibility Index™ (ASI™) matches vendor exposure against specific groups’ ATT&CK-mapped techniques.

How Do Tactics, Techniques, and Procedures Differ?

A tactic answers why, a technique answers how, and a procedure answers exactly how this time. Exploiting a public-facing application is a technique under the initial access tactic. The specific vulnerability a group weaponized to do it, on a specific date, against a specific product, is the procedure.

The enterprise matrix organizes attacker goals into a sequence that roughly follows the order of a real intrusion:

• Reconnaissance and resource development, where an attacker gathers information and builds infrastructure before touching a target.
• Initial access and execution, where the attacker gets into the environment and runs code.
• Persistence, privilege escalation, and defense evasion, where the attacker digs in and avoids getting caught.
• Credential access, lateral movement, and exfiltration, where the attacker moves through the environment and takes what it came for.

Reading a threat actor's profile against this sequence shows what a group does and the order it tends to do it in. That order is what makes the framework useful for anticipating a next move, beyond documenting the last one.

Which Threat Actors Does the Framework Track?

MITRE ATT&CK catalogs the confirmed, named behavior of ransomware and nation-state groups. Black Kite's 2026 Ransomware Report tracked 146 active ransomware groups by June 2026, up from 127 at the close of the reporting period and more than double the 61 Black Kite counted in 2023.

Qilin's Growth Shows How Fast TTPs Shift

The ransomware group Qilin grew from 250 victims to 1,358 in a single reporting period, a 443% increase, while operating across more than 50 countries. A vendor risk team working from a static threat profile even six months old would have missed the scale of that shift entirely.

Black Kite Maps Exposure to Named Adversaries

The Adversary Susceptibility Index™ (ASI™) filters a vendor ecosystem by susceptibility to specific named adversaries, including groups like Volt Typhoon, Black Basta, and APT29, by comparing each vendor's externally visible footprint against that adversary's known TTPs mapped to the ATT&CK framework. That's a different question than whether a vendor has vulnerabilities. It's whether a vendor's exposure matches how a specific, active group is known to operate, which is the question threat actor monitoring is built to answer.

How Does MITRE ATT&CK Differ From a Vulnerability Database?

ATT&CK documents attacker behavior, the actions taken once a flaw is already in play. A vulnerability database like CISA's known exploited vulnerabilities catalog lists specific flaws in specific products. ATT&CK sits a level above that. It describes what an attacker does with a flaw once it's exploited, which is why a single technique in the framework can be achieved through dozens of different individual vulnerabilities over time.

This distinction matters for vendor risk specifically. A vendor's patch backlog tells you what's broken. Mapping that backlog against active threat actor TTPs tells you which of those broken things a real adversary is actually likely to use, and against which of your vendors. Advanced Persistent Threat groups in particular tend to reuse a narrow set of techniques across many campaigns, a pattern a vulnerability count alone won't surface.

What Are the Limits of Mapping Vendor Risk to ATT&CK?

ATT&CK coverage marks where a program starts, and staying there leaves its map a step behind the newest attacks. A technique only enters the framework after it's confirmed in a real intrusion, so genuinely novel attacker behavior won't show up until it's already been used successfully somewhere.

There's a second limit specific to third-party risk. Black Kite's own Ransomware Susceptibility Index® (RSI™) and similar assessments read a vendor's externally visible footprint, the outside-in view that sits apart from a vendor's own internal telemetry.

That non-intrusive approach can flag whether a vendor's exposure resembles the conditions a specific group tends to exploit. External signals narrow the field, and confirming that a group is actively inside a given network still takes the vendor's own internal detection.

Vendors sharing common infrastructure raise the stakes on that gap. Black Kite's ransomware threat intelligence work exists partly because a technique that works against one vendor in an ecosystem often works against several others running the same stack. A program that only checks vendors one at a time misses that pattern until it's already spread.

See also: Top 10 Ways Threat Actors Are Targeting Companies