What is MITRE D3FEND?

D3FEND is MITRE's companion framework that catalogs defensive countermeasures and explicitly maps them to the ATT&CK techniques they mitigate. ATT&CK = offense; D3FEND = defense.

Do I have to map every threat to ATT&CK?

No. Map relevant adversary techniques where useful, while retaining device-specific threats and traceability to controls and tests. ATT&CK is not exhaustive and technique mapping does not itself validate a threat model.

All terms

CybersecurityAI / ML in Devices Connected & Cyber-Physical Devices Clinical EvidenceATT&CK

MITRE ATT&CK

Knowledge base of real-world adversary tactics, techniques, and procedures organized into a matrix used to model threats and assess defenses.

Reviewed by Christian Espinosa, Founder, Blue Goat CyberLast reviewed June 20, 2026

Definition

MITRE ATT&CK is a knowledge base of observed adversary tactics, techniques and sub-techniques, with Enterprise, Mobile and ICS domains. Major content releases generally occur twice yearly, with smaller updates between them. As of November 1, 2026 the current content version is v20.0, released October 13, 2026.

What the regulation says

FDA recommends device-specific threat modeling in its February 2026 premarket guidance. ATT&CK mapping can supplement threat identification and testing; it is not an FDA-mandated mapping scheme. Claims that FDA, HSCC JSP or AAMI TIR57 explicitly cite ATT&CK should be removed unless accompanied by a verified passage.

What this means in practice

Use ATT&CK selectively to enrich device-specific threat models, detection engineering and security testing. ICS techniques should be selected for architectural applicability, not applied automatically to every hospital device.

Examples

Illustrative: A medical device manufacturer uses the ATT&CK for ICS matrix to identify specific techniques an adversary might use to compromise an infusion pump, such as 'Program Download' or 'Input Data Manipulation'.
Illustrative: A hospital's security operations center maps observed network activity related to a medical imaging system to ATT&CK techniques like 'Remote Service Session Hijacking' to understand the adversary's intent and improve detection rules.
Illustrative: During a cybersecurity assessment, a red team emulates ATT&CK techniques, such as 'Valid Accounts' and 'Lateral Tool Transfer,' to test the defenses of a hospital's connected surgical robot system.

Common pitfalls

•Mapping threats to ATT&CK tactics only (the column headers) instead of specific techniques and sub-techniques, the granularity is the point.
•Treating ATT&CK as a checklist of controls rather than a reference of attacker behavior, defensive frameworks like D3FEND or NIST CSF cover controls.
•Ignoring ICS ATT&CK for hospital-deployed devices; many techniques in that matrix apply to networked imaging, lab analyzers, and infusion fleets.

Frequently asked questions

Lockheed Martin's Kill Chain is a seven-step linear model. ATT&CK is non-linear, far more granular (hundreds of techniques), and based on observed real-world behavior rather than a conceptual model.

Grouped by theme

Editor's picks

· Hand-selected related concepts

Cybersecurity

AAMI TIR57

AAMI Technical Information Report providing MedTech-specific guidance on cybersecurity risk management.

Cybersecurity

MITRE D3FEND(D3FEND)

MITRE's knowledge graph of defensive cybersecurity countermeasures, explicitly mapped to the ATT&CK techniques they mitigate.

Cybersecurity

NIST Cybersecurity Framework(NIST CSF)

A risk-based framework of cybersecurity functions and outcomes published by NIST and widely used to organize MedTech security programs.

Cybersecurity

Premarket Cybersecurity Submission

The bundle of cybersecurity artifacts a sponsor includes in a 510(k), De Novo, PMA, or HDE submission for a cyber device.

More in Cybersecurity

· Same category

Cybersecurity

STRIDE Threat Model(STRIDE)

A six-category framework for enumerating threats: Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege.

Cybersecurity

Threat Modeling

A structured analysis that identifies how an attacker could compromise a medical device and what controls mitigate each threat.

Cybersecurity

AAMI SW96

AAMI/ANSI standard establishing requirements for medical-device cybersecurity activities throughout the lifecycle.

Cybersecurity

AAMI TIR97(TIR97)

AAMI Technical Information Report on post-market security risk management for medical device manufacturers, the operational companion to TIR57.

Cited by

Where this term appears across MedTech Terms.

Ecosystems (3)

Latest in MedTech

Sources

5 sources

Sources support the definition or relevant regulatory context, not necessarily every claim on this page. Each is graded against our source-tier hierarchy so you can see what rests on binding law versus commentary.

Official-source claim check: 2026-11-01

MITRE catalogs observed adversary behavior in Enterprise, Mobile and ICS knowledge bases.

Partial review: verified corrections are applied, but this is not a full accuracy certification. The last full review date is unchanged.

Remaining verification limits

Secondary regulatory, standards-clause, market-prevalence or procurement claims were not fully substantiated by accessible original text.

Tier 2Regulator guidance and consensus· 5

Link health: 3 verified 2 unchecked· last checked 2026-06-20

MITRE·4FDA·1

Inline markers like [1] jump to the matching reference above.

My progress

All terms0 / 513

Cybersecurity0 / 61

Saved on this device, and to your account when signed in. View studied terms

Full glossary

Browse all terms A to Z, each with a short definition.

On this term

Category: Cybersecurity
Acronym: ATT&CK
Sources: 5
Updated: 6/20/2026

Compare with another term

Learn in 60 seconds

Knowledge base of real-world adversary tactics, techniques, and procedures organized into a matrix used to model threats and assess defenses.

·Use ATT&CK selectively to enrich device-specific threat models, detection engineering and security testing.
·ICS techniques should be selected for architectural applicability, not applied automatically to every hospital device.
·Major content releases generally occur twice yearly, with smaller updates between them.

Remember this

Watch out: Mapping threats to ATT&CK tactics only (the column headers) instead of specific techniques and sub-techniques, the granularity is the point.

Related terms

You may also need

Auto-suggested from Cybersecurity and shared keywords.

All Cybersecurity terms

From the Blue Goat network

Related resources and services on this topic.