Key takeaways
- EMB3D is explicitly designed to interoperate with, not replace, MITRE's other frameworks.
- Use the STIX 2.1 export if you have existing threat-intel tooling, but verify your own pipeline can handle EMB3D's custom Property objects and Markdown-based references before assuming full interoperability.
MITRE EMB3D is a free, public threat model purpose-built for embedded devices — the microcontroller- and SoC-based hardware running firmware inside routers, PLCs, medical devices, vehicles, and the other categories SoftWSP guides already cover. Instead of listing generic attack techniques, EMB3D starts from what a specific device actually has (its properties) and derives from that which threats realistically apply and which technical mitigations close them — a structure MITRE built specifically because general-purpose frameworks like ATT&CK weren't designed around embedded hardware's constraints.
Who built it, and why
MITRE announced a pre-release review version of EMB3D on 13 December 2023 jointly with Red Balloon Security and Narf Industries, naming Niyo "Little Thunder" Pearson (then of ONE Gas) as a contributing collaborator, and invited device vendors, asset owners, academics and researchers to review the draft ahead of a full public launch. MITRE's own About page for the project adds that a set of pilot organizations spanning energy, water, manufacturing, robotics, aerospace, health and automotive sectors, plus independent researchers and threat-tool vendors, contributed to shaping the content. MITRE's news release frames the motivation as the rising number of CISA ICS advisories affecting embedded devices across critical infrastructure, and the lack, until EMB3D, of a common framework connecting device characteristics directly to attacker-relevant threats and vendor-actionable mitigations.
The three-part structure
Per MITRE's EMB3D white paper, the model is organized into three linked knowledge bases:
| Part | What it contains | Organized by |
|---|---|---|
| Device Properties | A device's hardware and software features and capabilities — what it has, not what's wrong with it | Four top-level categories: Hardware, System Software, Application Software, Networking, each broken into sub-properties |
| Threats | Attacker goals/impacts achievable against a device that has a given property, including the attacker actions required and the CWEs/CVEs that enable the threat | Threat IDs (TIDs) mapped back to the specific properties that expose a device to them |
| Mitigations | Technical mechanisms/technologies a vendor can build into the device to defend against a threat, plus known limitations of each | Maturity tiers — Foundational (the largest group, 45 entries per MITRE's own count), Intermediate (31), and Leading (10, the newest and least-established techniques) |
The site's own "Getting Started" guidance describes the intended workflow end to end: identify which Device Properties apply to the device under review (from documentation or device knowledge), select them in the Properties Mapper tool to generate the resulting Threat list, then check which Mitigations are already implemented to see what residual threat exposure remains — turning EMB3D into a working threat-modeling and gap-analysis tool rather than just a reference document.
How it relates to ATT&CK, CWE and CVE
EMB3D is explicitly designed to interoperate with, not replace, MITRE's other frameworks. Per MITRE's own description, EMB3D "expands on existing models including MITRE's ATT&CK framework and Common Weakness Enumeration" — a given EMB3D Threat entry cites the CWEs and CVEs that make the threat concrete, and separately can be cross-referenced against the adversary tactics and techniques in ATT&CK Enterprise or ATT&CK for ICS that describe how an attacker would actually carry the threat out in the field. For defensive mapping once mitigations are in place, MITRE's D3FEND knowledge graph covers the broader defensive-technique taxonomy that EMB3D's device-specific mitigations sit alongside.
Version history: from draft to a living, machine-readable model
| Date | Version | What changed |
|---|---|---|
| 13 Dec 2023 | Pre-release/review draft | Announced jointly by MITRE, Red Balloon Security and Narf Industries for public review before full launch |
| 2024 | Full public release (Properties + Threats) | Properties and Threats became the first content made fully available |
| Fall 2024 | Mitigations added | MITRE's own version-history notes describe this as the point EMB3D reached "content completion" |
| 22 Apr 2025 | v2.0 | First major update since content completion: added a machine-readable STIX 2.1 representation of the full dataset (to support integration with other threat/vulnerability tooling), plus new properties, two new logging-related threats (TID-225, TID-226), and six new mitigations covering formal-methods approaches and log management |
| 29 Apr 2025 | v2.0.1 | Patch release correcting a threat naming error (TID-213 reverted to its correct name) |
| 1 Jun 2026 | v2.0.2 | Usability update (shareable Properties Mapper state via URL) plus updates to the site's Terms of Use and copyright references; no change to threat or mitigation content |
MITRE's own documentation describes known limits of the STIX 2.1 export as of v2.0.x: EMB3D Threats map to STIX vulnerability objects and Mitigations to course-of-action objects, but Properties "do not map well to standard STIX data types" and are expressed as custom objects, and reference/evidence material is still carried as free-form Markdown text rather than structured external-reference objects — both flagged by MITRE as targets for a future release rather than settled features.
A workable starting point
Run the Properties Mapper against one real device first, rather than trying to threat-model your whole product line abstractly — EMB3D's output quality depends on accurately identifying which Device Properties actually apply. Treat Mitigation tiers as a prioritization signal, not a pass/fail grade— Foundational mitigations (45 of them) are the largest, most-established category; Leading mitigations (10) are newer techniques with less field validation, per MITRE's own tier structure. Cross-reference generated Threats against your existing CVE/CWE tracking— EMB3D's Threat entries already cite the CWEs/CVEs that enable them, so this is largely a matter of confirming your vulnerability-management pipeline (see KEV/EPSS prioritization) already watches for the same weakness classes. Use the STIX 2.1 export if you have existing threat-intel tooling, but verify your own pipeline can handle EMB3D's custom Property objects and Markdown-based references before assuming full interoperability. Check the Version History page before citing a specific Threat or Mitigation ID in a document— EMB3D is an actively maintained, living framework, and IDs/definitions have already changed between v2.0 and v2.0.1.
SoftWSP's firmware assessments build the device-property and component-level evidence — what hardware and software features a device actually has, and which known CVEs affect them — that an EMB3D-driven threat model needs as its starting input: see device & firmware security.
This guide summarises MITRE's own published EMB3D web site, white paper and news releases; it is not a substitute for reading the current emb3d.mitre.org content directly, and does not constitute security or compliance advice.
Sources
- MITRE EMB3D — official site (home, Device Properties / Threats / Mitigations, Properties Mapper tool)
- MITRE EMB3D — About (origin, contributors, mitigation maturity tier counts, Terms of Use reference)
- MITRE EMB3D — Version History (v2.0, v2.0.1, v2.0.2 release notes)
- MITRE EMB3D — Getting Started (Properties Mapper workflow)
- MITRE EMB3D Threat Model white paper (PDF, ©2024 The MITRE Corporation, approved for public release)
- MITRE: "MITRE, Red Balloon Security, and Narf Announce EMB3D" (news release, 13 December 2023)
- Industrial Cyber: "MITRE's EMB3D 2.0 update improves threat coverage, STIX integration for better security tools compatibility"
Frequently asked questions
What is MITRE EMB3D?
EMB3D is a free, publicly available threat model for embedded devices — the kind found in critical infrastructure, IoT, automotive, healthcare and manufacturing equipment. MITRE's own About page describes it as "a knowledge base of cyber threats and associated mitigations for embedded devices." It was developed by MITRE together with Red Balloon Security, Narf Industries, and Niyo "Little Thunder" Pearson (then of ONE Gas), with input from pilot organizations across energy, water, manufacturing, robotics, aerospace, health and automotive sectors.
How is EMB3D structured?
Three linked parts, per MITRE's own EMB3D white paper: Device Properties (a device's hardware and software features and capabilities, grouped into categories such as hardware, system software, application software and networking), Threats (attacker goals/impacts achievable against a device with given properties, each threat documenting the targeted properties, the attacker actions required, and the vulnerabilities or weaknesses that enable it), and Mitigations (the technical mechanisms that defend against a given threat, tagged Foundational, Intermediate or Leading by how mature/established the approach is). The site's own "Getting Started" workflow has a user pick applicable Device Properties in the Properties Mapper Tool to generate a relevant Threat list, then check which Mitigations are already in place.
When was EMB3D released, and is it still being updated?
MITRE, Red Balloon Security and Narf Industries announced a pre-release/review version on 13 December 2023, with the full public release of Properties and Threats following in 2024 and Mitigations reaching content completion in fall 2024. Since then it has shipped v2.0 (22 April 2025, adding a machine-readable STIX 2.1 representation plus new properties, threats and mitigations), v2.0.1 (29 April 2025, a naming-correction patch), and v2.0.2 (1 June 2026, usability and Terms of Use/copyright updates). MITRE describes it as a living framework that is updated as new threat actors, vulnerabilities and defenses are documented.
How does EMB3D relate to MITRE ATT&CK, CWE and CVE?
EMB3D is a companion framework, not a replacement. Per MITRE's own materials it "expands on existing models including MITRE's ATT&CK framework and Common Weakness Enumeration," letting a user map an EMB3D Threat to the CWEs and CVEs that enable it and, separately, to the adversary tactics/techniques in [ATT&CK](/guides/mitre-attack-enterprise/) or [ATT&CK for ICS](/guides/mitre-attack-for-ics/) that an attacker would use to exploit it. EMB3D's own focus is device-property-driven threat exposure and technical mitigation guidance, which ATT&CK and CWE do not provide in that form.
Is EMB3D free to use, and under what terms?
Yes — the model, its web site (emb3d.mitre.org) and the Properties Mapper tool are published for public use at no cost. MITRE states the site content is "\u00a92026 The MITRE Corporation" and governed by MITRE's Terms of Use (the same structure used for ATT&CK), and the underlying EMB3D Threat Model white paper is marked "Approved for public release." This guide has not independently reviewed the full Terms of Use text for redistribution limits, so treat anything beyond read-and-reference use (e.g. bulk reuse of the STIX dataset in a commercial product) as to be confirmed against MITRE's own terms before relying on it.
More guides
