MITRE ATT&CK is a free, globally adopted knowledge base of adversary tactics and techniques based on real-world observations. The framework organises how attackers operate into tactics (their goals, such as Initial Access or Exfiltration) and techniques (how they achieve each goal), giving defenders a common language to describe, detect, and measure threats.
MITRE ATT&CK Framework
MITRE ATT&CK simulation coverage, measured on your live controls.
MITRE ATT&CK simulation turns the framework from a static matrix into evidence: Valitrix replays ATT&CK techniques against endpoint, email, network, and SIEM controls and reports what was detected, blocked, logged, or missed — per technique, continuously.
14
Enterprise tactics
200+
Techniques covered
Per-technique
Detection scoring
Continuous
Re-validation
MITRE ATT&CK simulation
What is MITRE ATT&CK simulation?
A coverage spreadsheet that ticks ATT&CK technique IDs is not coverage. MITRE ATT&CK simulation is the test: Valitrix safely replays those techniques against your live stack and records whether each one was prevented, detected, logged only, or missed. That is how “we map to ATT&CK” becomes a per-technique score you can act on.
This page is the measurement guide. The Breach and Attack Simulation platform is the engine that runs the simulations continuously.
The framework
What is the MITRE ATT&CK framework?
MITRE ATT&CK (Adversarial Tactics, Techniques & Common Knowledge) is a free, openly maintained knowledge base of how real attackers behave, built from observed intrusions. It breaks an attack into tactics — the adversary's goals, such as Initial Access or Exfiltration — and techniques — the specific methods used to achieve each goal. You can explore the full matrix at attack.mitre.org.
Where the older cyber kill chain describes an attack as seven linear stages, the MITRE ATT&CK framework is more granular and reflects how modern intrusions actually unfold — non-linear, with hundreds of techniques across 14 enterprise tactics. That precision is what makes ATT&CK the standard language for detection engineering and measuring coverage.
Kill chain vs ATT&CK
Cyber Kill Chain
Recon→Weaponize→Deliver→Exploit→Install→C2→Actions
Seven linear stages — a high-level narrative.
MITRE ATT&CK
14 tactics × hundreds of techniques — non-linear and measurable. Highlighted cells = techniques Valitrix validated.
The matrix, validated
Every tactic, tested against real defenses.
Valitrix safely emulates adversary behaviour across the full ATT&CK lifecycle, then measures whether each control detected, blocked, or missed it — mapped technique by technique.
01Email + Endpoint
Initial Access & Execution
How attackers get a foothold and run malicious code once inside.
PhishingValid AccountsPublic-Facing ExploitScripting
02Endpoint
Persistence & Privilege Escalation
Keeping access across reboots and elevating to higher privileges.
Web ShellAccount ManipulationValid Accounts
03Endpoint + SIEM
Defense Evasion & Credential Access
Avoiding detection and stealing the credentials that unlock the network.
Credential DumpingBrute ForceObfuscation
04Network + SIEM
Lateral Movement & C2
Moving between hosts and talking to external infrastructure.
Remote ServicesApp-Layer ProtocolRemote Exploit
05Network + DLP
Collection & Exfiltration
Staging and stealing data — the techniques behind most breaches.
Data from ReposExfil over C2Exfil over Web
06Endpoint
Impact
Ransomware, data destruction, and service disruption.
Data EncryptedData DestructionResource Hijacking
From framework to evidence
Knowing the techniques isn't the same as detecting them.
Valitrix runs continuous breach and attack simulation mapped to ATT&CK, producing a per-technique detection and prevention score across endpoint, email, network, and SIEM controls — so your ATT&CK matrix shows real, measured coverage instead of assumptions.
ATT&CK coverage
IllustrativeInitial Access92% detect · 78% prevent
Credential Access71% detect · 54% prevent
Lateral Movement64% detect · 42% prevent
Exfiltration80% detect · 61% prevent
Impact88% detect · 73% prevent
Detected Prevented Mapped to ATT&CK
MITRE ATT&CK FAQThe MITRE ATT&CK framework,
The MITRE ATT&CK framework,
explained.
The Lockheed Martin Cyber Kill Chain describes an attack as seven linear stages, from reconnaissance to actions on objectives. MITRE ATT&CK is more granular and non-linear: it catalogues hundreds of specific techniques mapped to 14 enterprise tactics, reflecting that real intrusions rarely follow a single straight path. Many teams use the kill chain for high-level narrative and ATT&CK for detailed detection engineering and coverage measurement.
The Enterprise ATT&CK matrix currently covers 14 tactics — Reconnaissance, Resource Development, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration, and Impact — spanning hundreds of techniques and sub-techniques that are updated as new adversary behaviour is observed.
MITRE ATT&CK simulation is the practice of safely replaying ATT&CK techniques against live controls to measure what is actually detected, blocked, logged, or missed. Unlike a static coverage spreadsheet, a MITRE ATT&CK simulation produces evidence per technique — so you can see real detection gaps instead of assumed coverage.
The MITRE ATT&CK coverage page is the measurement layer: tactics, techniques, and per-technique detection scoring. The Breach and Attack Simulation platform is the engine that runs those simulations continuously across endpoint, email, network, and SIEM. Use this page to understand the framework; use the BAS page to evaluate the product that validates it.
Valitrix maps every breach and attack simulation to specific MITRE ATT&CK techniques. It safely emulates real adversary behaviour against your live controls and reports a per-technique detection and prevention rate — turning the framework from a static reference into a measured, continuously updated picture of your real ATT&CK coverage.
See your real ATT&CK coverage
Ready to see if your defenses can stop real attacks?
Request a demonstration of MITRE ATT&CK-mapped breach and attack simulation in your environment.