MITRE ATT&CK for ICS: the adversary tactics and techniques matrix, explained

MITRE ATT&CK for ICS is a dedicated knowledge base, inside MITRE's broader ATT&CK framework, of the tactics and techniques adversaries use against industrial control systems. It launched on 7 January 2020, and per Help Net Security's coverage of that launch, it "adds the behavior adversaries use within ICS environments," highlighting "the unique aspects of the specialized applications and protocols that ICS system operators typically use, and adversaries take advantage of, to interface with physical equipment." The current release is v20.0, published 13 October 2026 per MITRE's own version-history page, and it still organizes that behavior into 12 tactics — the same count the matrix has used since launch.

Why a separate matrix for ICS

MITRE's general ATT&CK knowledge base — which its own FAQ page states "started in 2013" — was built around enterprise IT behavior. Help Net Security's reporting on the ICS launch notes that "some aspects of the existing ATT&CK knowledge base for enterprise IT systems are applicable to ICS, and in many cases may represent an entry point into those ICS systems for adversaries," but industrial environments introduce behavior with no enterprise-IT equivalent: interaction with engineering workstations, industrial protocols, and the physical process itself. ATT&CK for ICS exists to document that behavior on its own terms rather than force it into the Enterprise matrix.

The 12 tactics

MITRE's ICS matrix page lists the following tactics, in this order:

#	Tactic
1	Initial Access
2	Execution
3	Persistence
4	Privilege Escalation
5	Evasion
6	Discovery
7	Lateral Movement
8	Collection
9	Command and Control
10	Inhibit Response Function
11	Impair Process Control
12	Impact

The last three — Inhibit Response Function, Impair Process Control, and Impact — have no direct Enterprise-matrix counterpart; they describe an adversary acting on the physical process itself, which is the behavior unique to ICS.

What's in the current (v20) matrix

MITRE's October 2026 update page gives the following counts for the ICS matrix in v20:

Object type	Count (v20, October 2026)
Tactics	12
Techniques	78
Sub-techniques	26
Groups	14
Software	25
Campaigns	10
Mitigations	53
Assets	18
Detection strategies	106

The same update page notes that v20 introduced a Command and Scripting Interpreter technique with six new sub-techniques (covering PowerShell, Windows Command Shell, Unix Shell, Visual Basic, Python and JavaScript execution in ICS environments), added two new campaigns ("2026 U.S. Water Utilities Attacks" and an "AI-Assisted Breach of Mexico's Government Infrastructure"), added nine detection strategies for behavioral detection of scripting and protocol abuse, and deprecated two older techniques (Command-Line Interface and Scripting) in favor of the new sub-techniques. These counts move with every six-month ATT&CK release, so a reader relying on a specific number should check MITRE's live update page for the current release rather than treat this table as permanently current.

Where detections and mitigations came from

ATT&CK for ICS launched with techniques, software and group data; per MITRE's October 2022 (v12) update — the release that first brought formal detection content to ATT&CK for ICS, matching a model already introduced to ATT&CK Enterprise in v11 — ICS detections began describing ways of detecting specific ICS techniques tied to named data sources and data components. That detection layer is what the 106 detection strategies in the v20 table above build on.

Using it alongside IEC 62443 and SP 800-82

ATT&CK for ICS is a behavior-mapping framework, not a requirements standard — it doesn't replace a program like IEC 62443-2-1 asset-owner security program or NIST SP 800-82 OT security guidance. The practical fit is complementary: those standards tell an asset owner what controls and program elements to put in place, while ATT&CK for ICS gives a common vocabulary for describing a specific threat group's or incident's behavior, checking it against the mitigations and detections already documented for that technique, and finding gaps in monitoring coverage.

A workable starting point

1. Pick the matrix that matches your environment — a single OT network may touch techniques from multiple tactics (e.g. Lateral Movement into Impair Process Control); don't assume Initial Access coverage implies coverage further down the kill chain.
2. Map known incidents and threat-group reporting onto ATT&CK for ICS techniques before building new detections from scratch, since MITRE's own groups/software/campaign entries already link many public incidents to specific techniques.
3. Use the mitigations list as a starting checklist, then verify against your own architecture — generic ATT&CK mitigations (network segmentation, allow-listing) still need to be scoped to the specific protocols and assets in your environment.
4. Re-check counts against the live matrix on a cadence — MITRE revises ATT&CK roughly twice a year, and technique/sub-technique counts (and occasionally tactic definitions) change between releases.

SoftWSP's passive OT assessments map observed traffic and asset behavior against frameworks like ATT&CK for ICS rather than asking a factory to install new agents first: see OT network assessment.

This guide summarises public MITRE ATT&CK publications and contemporaneous reporting on the ICS matrix's 2020 launch; it does not constitute security or compliance advice.