Key takeaways
- CAPEC (Common Attack Pattern Enumeration and Classification) is MITRE's catalog of how adversaries actually carry out an attack, not just which weakness they exploit or which specific vulnerability they target.
- The current catalog is CAPEC List Version 3.9, released 24 January 2023 and, as of this guide's publication, still the live version — MITRE's list page shows no newer numbered release as of late 2026.
- CAPEC is deliberately scoped differently from MITRE's other well-known framework, ATT&CK.
- Start from CAPEC-703 if your focus is OT/ICS, rather than screening the full 559-entry catalog — it's a pre-scoped 46-pattern starting set built with ATT&CK for ICS as an input.
CAPEC (Common Attack Pattern Enumeration and Classification) is MITRE's catalog of how adversaries actually carry out an attack, not just which weakness they exploit or which specific vulnerability they target. Per MITRE's own About page, it is "a publicly available catalog of common attack patterns that helps users understand how adversaries exploit weaknesses in applications and other cyber-enabled capabilities." Originally established by the US Department of Homeland Security as part of its Software Assurance strategic initiative, CAPEC is now sponsored by DHS's Cybersecurity and Infrastructure Security Agency (CISA) and managed by the Homeland Security Systems Engineering and Development Institute (HSSEDI), which MITRE operates — the same sponsorship structure that funds CWE and CVE.
What an "attack pattern" actually documents
MITRE's "New to CAPEC" page is explicit about where CAPEC sits relative to the other weakness/vulnerability catalogs a firmware or application security team already tracks: "a CAPEC attack pattern is typically a method of leveraging a CWE to execute an attack." Each entry documents "step-by-step instructions for an adversary to explore for potential targets, experiment with their assets and defensive mechanisms, if any, and then to carry out the exploit." The important distinction MITRE draws is that CAPEC entries describe method, not outcome: "CAPEC entries are not based on the consequences of an attack, but on how to exploit a weakness to cause the consequence." In practice, that gives a security team three distinct, cross-referenced layers to work with:
| Catalog | What it names |
|---|---|
| CWE | The underlying weakness class (e.g. improper input validation) — see our CWE Top 25 guide |
| CAPEC | The reusable adversary method for turning that weakness into a working attack |
| CVE | One specific, concrete instance of a vulnerability in a named product/version |
How the catalog is organized
The current catalog is CAPEC List Version 3.9, released 24 January 2023 and, as of this guide's publication, still the live version — MITRE's list page shows no newer numbered release as of late 2026. It contains 559 total attack patterns, browsable through two independent classification views plus a three-tier abstraction scale:
- Mechanisms of Attack — MITRE's own description: this view "organizes attack patterns hierarchically based on mechanisms that are frequently employed when exploiting a vulnerability," grouping entries by how the attack is technically carried out (e.g. injection, spoofing, resource depletion).
- Domains of Attack — groups attack patterns "by the target domains" they apply to, independent of the underlying mechanism.
- Abstraction levels — every entry is tagged Meta, Standard, or Detailed, running from broad, high-level attack concepts down to narrow, highly specific, step-by-step patterns; a Meta pattern groups several related Standard or Detailed patterns underneath it.
CAPEC vs. ATT&CK: application security vs. network defense
CAPEC is deliberately scoped differently from MITRE's other well-known framework, ATT&CK. MITRE's own published comparison draws the line at the application-security/network-defense boundary:
| CAPEC | ATT&CK | |
|---|---|---|
| Scope | "focused on application security and describes the common attributes and techniques employed by adversaries to exploit known weaknesses" | "focused on network defense and describes the operational phases in an adversary's lifecycle" |
| Primary use cases | Application threat modeling, developer training and education, penetration testing | Comparing network defense capabilities, defending against advanced persistent threats, threat hunting |
MITRE notes the two are complementary rather than overlapping: "many attack patterns enumerated by CAPEC are employed by adversaries through specific techniques described by ATT&CK," and the catalogs carry cross-references so a CAPEC entry can point to the ATT&CK technique(s) an adversary would use to execute it operationally, while an ATT&CK technique can point back to the application-level CAPEC patterns that realize it against a specific weakness.
The dedicated ICS/OT view
For teams working on operational technology, CAPEC publishes CAPEC-703, "Industrial Control System (ICS) Patterns," a curated view whose stated objective is "a listing of CAPECs that apply to industrial control systems (ICS)," noting that "some children of these attack patterns might also be applicable" even where not explicitly listed. As of CAPEC v3.9, this view groups 46 of the catalog's 559 attack patterns, built in part using the ATT&CK for ICS matrix as an input, and spans the same Meta-to-Detailed abstraction range as the full catalog — from broad patterns like adversary-in-the-middle and flooding down to detailed patterns tied to specific ICS-relevant exploitation techniques. It gives an OT security team a pre-filtered starting point instead of manually screening all 559 entries for industrial relevance.
Licence and reuse terms
MITRE's Terms of Use for CAPEC state: "The MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use Common Attack Pattern Enumeration and Classification (CAPEC™) for research, development, and commercial purposes," conditioned on reproducing "MITRE's copyright designation and this license in any such copy." That means CAPEC content can be reused, including commercially, as long as attribution and the licence text travel with the copy — the same free-to-use-with-attribution model MITRE applies to CWE and ATT&CK.
A workable starting point
Use CAPEC to fill the gap between "what's wrong" and "what an attacker actually does."If your team already tracks CWE classes and CVE instances, CAPEC is the missing middle layer that documents the reusable method connecting the two — valuable input for threat modeling sessions and penetration-test scoping. Start from CAPEC-703 if your focus is OT/ICS, rather than screening the full 559-entry catalog — it's a pre-scoped 46-pattern starting set built with ATT&CK for ICS as an input. Cross-reference generated or discovered CAPEC entries against your own CWE/CVE tracking, the same discipline our EMB3D and CWE Top 25 guides recommend for MITRE's other knowledge bases — CAPEC is explicitly designed to interlock with both. Treat CAPEC as a penetration-testing and threat-modeling input, not an incident-response taxonomy— for the adversary-lifecycle/TTP view used in detection engineering and threat hunting, MITRE's own guidance points to ATT&CK instead. Check the list version before citing a specific CAPEC-ID in a documentCAPEC v3.9 (24 January 2023) is current as of this guide, but MITRE revises the catalog periodically; verify against capec.mitre.org directly before relying on an entry's exact wording or ID in an audit artifact.
SoftWSP's firmware and device assessments identify the CWE-class weaknesses present in a real codebase or binary; CAPEC is the complementary layer that documents how an adversary would actually weaponize those weaknesses in the field, which is what a threat-model or penetration-test scope built on our findings should reference next: see device & firmware security.
This guide summarises MITRE's own published CAPEC web site and Terms of Use; it is not a substitute for reading the current capec.mitre.org content directly, and does not constitute security or compliance advice.
Sources
- MITRE CAPEC — About CAPEC (sponsorship, HSSEDI management)
- MITRE CAPEC — New to CAPEC (attack pattern definition, relation to CWE/CVE)
- MITRE CAPEC — CAPEC and ATT&CK (official comparison)
- MITRE CAPEC — CAPEC List Version 3.9 (current list landing page, 559 patterns)
- MITRE CAPEC — CAPEC-703: Industrial Control System (ICS) Patterns view
- MITRE CAPEC — About CAPEC: Terms of Use (non-exclusive, royalty-free licence)
Frequently asked questions
What is CAPEC?
CAPEC (Common Attack Pattern Enumeration and Classification) is a free, publicly available catalog of common attack patterns. MITRE's own About page describes it as helping "users understand how adversaries exploit weaknesses in applications and other cyber-enabled capabilities," documenting "the common attributes and approaches employed by adversaries to exploit known weaknesses." It was established by the US Department of Homeland Security as part of the Software Assurance strategic initiative, and per MITRE's own sponsorship model (the same structure used for CWE and CVE) it is currently sponsored by DHS's Cybersecurity and Infrastructure Security Agency (CISA) and managed by the Homeland Security Systems Engineering and Development Institute (HSSEDI), which MITRE operates.
What exactly is an "attack pattern", and how is it different from a CWE or a CVE?
Per MITRE's own "New to CAPEC" page, "a CAPEC attack pattern is typically a method of leveraging a CWE to execute an attack," with "step-by-step instructions for an adversary to explore for potential targets, experiment with their assets and defensive mechanisms... and then to carry out the exploit." MITRE is explicit that "CAPEC entries are not based on the consequences of an attack, but on how to exploit a weakness to cause the consequence" — a CWE (see our [CWE Top 25 guide](/guides/cwe-top-25-software-weaknesses/)) names the underlying flaw class, a CVE names one specific instance of a vulnerability, and a CAPEC attack pattern documents the reusable adversary *method* that turns a given CWE into a working exploit.
How is CAPEC structured, and how big is the current list?
The current list is CAPEC List Version 3.9, released 24 January 2023 and still the live version as of this guide, containing 559 total attack patterns. Patterns are organized along two independent views — Mechanisms of Attack, which "organizes attack patterns hierarchically based on mechanisms that are frequently employed when exploiting a vulnerability," and Domains of Attack, which groups patterns "by the target domains" they apply to — and across three abstraction levels, Meta, Standard and Detailed Attack Patterns, from broad/high-level patterns down to highly specific, step-by-step ones.
How does CAPEC relate to MITRE ATT&CK?
They are complementary, not duplicates. MITRE's own comparison states CAPEC is "focused on application security and describes the common attributes and techniques employed by adversaries to exploit known weaknesses," useful for "application threat modeling, developer training and education, [and] penetration testing," while [ATT&CK](/guides/mitre-attack-enterprise/) is "focused on network defense and describes the operational phases in an adversary's lifecycle," useful for "comparing computer network defense capabilities" and "hunting for new threats." MITRE adds that "many attack patterns enumerated by CAPEC are employed by adversaries through specific techniques described by ATT&CK," and the two catalogs carry cross-references so a given CAPEC entry can point to the ATT&CK technique(s) that realize it in the field.
Is there a CAPEC view specific to industrial control systems / OT?
Yes. CAPEC-703, "Industrial Control System (ICS) Patterns," is a dedicated view whose stated objective is to contain "a listing of CAPECs that apply to industrial control systems (ICS)" (noting "some children of these attack patterns might also be applicable"). As of CAPEC v3.9 it groups 46 of the catalog's 559 attack patterns, built in part using the [ATT&CK for ICS](/guides/mitre-attack-for-ics/) matrix, and spans abstraction levels from meta-level patterns (e.g. adversary-in-the-middle, flooding) down to detailed patterns addressing specific ICS-relevant techniques.
In this cluster
