MITRE ATT&CK for Enterprise: the 15 tactics, explained

MITRE ATT&CK for Enterprise is the original and largest matrix in MITRE's ATT&CK knowledge base, documenting adversary behavior against Windows, macOS, Linux, cloud (IaaS/SaaS), identity provider, network, container and virtualization (ESXi) environments. MITRE's own homepage describes ATT&CK as "a globally-accessible knowledge base of adversary tactics and techniques based on real-world observations," free for "any person or organization for use at no charge." The current release, v20.0, published 13 October 2026 per MITRE's version-history page, organizes that behavior into 15 tactics — a count that changed for the first time in years when MITRE restructured one long-standing tactic in its April 2026 release. For the dedicated matrix covering industrial control systems rather than enterprise IT, see our MITRE ATT&CK for ICS guide.

Where ATT&CK came from

MITRE's own FAQ page states the project "started ATT&CK in 2013" to document "common tactics, techniques, and procedures (TTPs) that advanced persistent threats use against Windows enterprise networks," created for a MITRE research project called FMX that investigated using endpoint telemetry and analytics to improve post-compromise detection. ATT&CK became the shared vocabulary that both the offensive sensors-testing side and the defensive detection side of that project used to describe the same behavior, and that same "why/how/specific-implementation" structure is what the public ATT&CK knowledge base still uses today.

Tactics, techniques, sub-techniques and procedures

MITRE's FAQ defines the four levels of the model precisely:

Level	MITRE's definition	Example
Tactic	The adversary's tactical goal — the "why"	Credential Access
Technique	"How" an adversary achieves that goal	Dumping credentials
Sub-technique	"A more specific description of the adversarial behavior... at a lower level than a technique"	Dumping credentials via LSA Secrets
Procedure	"The specific implementation the adversary uses," documented as real, observed behavior	A named group using PowerShell to inject into lsass.exe and scrape memory

Sub-techniques categorize behavior; procedures describe specific in-the-wild use of that behavior, and per MITRE's FAQ a single procedure "may include several additional behaviors," spanning more than one technique or sub-technique at once.

The 15 Enterprise tactics

MITRE's own Enterprise tactics page lists these, in this order, each with its own short definition of the adversary's goal:

#	Tactic	The adversary is trying to...
1	Reconnaissance	gather information to plan future operations
2	Resource Development	establish resources to support operations
3	Initial Access	get into your network
4	Execution	run malicious code or instructions on a system
5	Persistence	maintain their foothold
6	Privilege Escalation	gain higher-level permissions
7	Stealth	hide and conceal their actions, appearing as normal behavior
8	Defense Impairment	break security mechanisms, pipelines, and tooling so defenders can't see or trust what's happening
9	Credential Access	steal account names and passwords
10	Discovery	figure out your environment
11	Lateral Movement	move through your environment
12	Collection	gather data of interest to their goal
13	Command and Control	communicate with compromised systems to control them
14	Exfiltration	steal data
15	Impact	manipulate, interrupt, or destroy your systems and data

The 2026 Defense Evasion split

The two tactics in bold above are new. MITRE's own April 2026 (v19) release notes state plainly that "the biggest changes in ATT&CK v19 are the split of the Defense Evasion Tactic in Enterprise ATT&CK into the Stealth and Defense Impairment Tactics." The old Defense Evasion tactic (TA0005) — long one of the best-known names in the framework — was retired as a single category and its techniques redistributed based on adversary intent rather than kept together as one catch-all:

• Stealth inherited Defense Evasion's old tactic ID (TA0005). MITRE's own Stealth page states the adversary here "is trying to hide and conceal their actions, appearing as normal behavior," through techniques "characterized by concealment behaviors, such as avoiding, obfuscating, or mimicking normal operations, without modifying security controls or compromising collection and monitoring feeds" — defenses stay intact; the adversary is simply not seen.
• Defense Impairment is a brand-new tactic with a new ID (TA0112). MITRE's own page states the adversary here "is trying to break security mechanisms, pipelines, and tooling so defenders can't see or trust what's happening," through techniques that "degrade, disable, or undermine the effectiveness and trustworthiness of security controls and monitoring mechanisms" — the defenses themselves are the target.

MITRE's release notes note that "a post describing the rationale behind the Defense Evasion split was published to ATT&CK's Blog in March," ahead of the April 2026 release, giving defenders advance notice that detections, reports and coverage maps referencing "Defense Evasion" by name would need to be re-pointed at one or both of the new tactics. MITRE's October 2026 (v20) release left this split unchanged; v20's own changes were elsewhere, mainly expanded campaign and technique coverage rather than further tactic restructuring.

Technique volume moves with every release

MITRE revises ATT&CK roughly twice a year (April and October), and technique/sub-technique/group counts shift every release even when the tactic list itself is stable. As of v20.0 (13 October 2026), MITRE's own Enterprise matrix lists technique counts per tactic ranging from 9 (Resource Development, Lateral Movement) up to 34 (Discovery), and MITRE's own October 2026 update page gives Enterprise totals of 227 techniques, 479 sub-techniques, 178 groups, 842 pieces of software, and 57 campaigns for that release. A reader citing a specific count should check MITRE's live update page for the current release rather than treat any single release's numbers as permanently current.

How this is used — and what it isn't

ATT&CK for Enterprise is a behavior-mapping vocabulary, not a controls checklist or a maturity model. It is typically used, per MITRE's own guidance, for four things: building detection analytics tied to specific techniques, structuring threat-intelligence reporting in a common vocabulary, planning adversary emulation and red-team exercises against named techniques, and assessing security-tooling coverage gaps technique by technique. It complements rather than replaces frameworks that set security requirements — NIST SP 800-53 controls, for instance, are the kind of defensive measure that gets mapped against specific ATT&CK techniques to check coverage, and the KEV/EPSS and SSVC guides cover complementary ways of prioritizing which vulnerabilities actually enable the techniques in a given environment. For industrial control systems specifically, MITRE maintains a separate ATT&CK for ICS matrix with its own 12-tactic structure — see our dedicated guide for how that differs from Enterprise.

A workable starting point

1. Re-point any "Defense Evasion" references first. Internal detections, dashboards or reports that still cite the old 14-tactic model should be updated to Stealth and/or Defense Impairment before they silently go stale.
2. Use tactics to organize, techniques to act. A tactic tells you the adversary's goal; the actionable unit for detection engineering is almost always the technique or sub-technique level.
3. Treat procedure examples as evidence, not requirements. A technique's documented "Procedure Examples" show how real threat actors have implemented it — useful for prioritizing detections toward observed behavior, not an exhaustive list of every possible implementation.
4. Re-check counts against the live site before publishing them. Technique, sub-technique and group counts move with each biannual release; MITRE's own update pages are the authoritative source for the current numbers.

SoftWSP's firmware and device assessments map discovered exposure and behavior against ATT&CK techniques rather than scoring severity in isolation: see device & firmware security services.

This guide summarises public MITRE ATT&CK publications current as of the v20.0 release (13 October 2026); it does not constitute security or compliance advice.