--- title: "ATT&CK, MITRE ATT&CK | MedTech Terms" description: "Knowledge base of real-world adversary tactics, techniques, and procedures organized into a matrix used to model threats and assess defenses." lang: en json-ld: | { "@context": "https://schema.org", "@graph": [ { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/mitre-attack#term", "name": "MITRE ATT&CK", "alternateName": [ "ATT&CK", "Adversarial Tactics, Techniques & Common Knowledge" ], "description": "MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) is a globally accessible framework that catalogs observed adversary behavior across the full attack lifecycle. It is organized as a matrix of tactics (the attacker's goal, e.g., Initial Access, Execution, Persistence, Lateral Movement, Exfiltration) and the specific techniques and sub-techniques attackers use to achieve each. ATT&CK is maintained by MITRE under government and community funding and is updated quarterly. Separate matrices exist for Enterprise, Mobile, ICS (Industrial Control Systems), and the mappings are widely used by SOCs, threat intel teams, red teams, and increasingly by medical device security teams.", "url": "https://medtechterms.com/terms/mitre-attack", "termCode": "mitre-attack", "inDefinedTermSet": { "@type": "DefinedTermSet", "name": "MedTech Terms", "url": "https://medtechterms.com/terms" } }, { "@type": "Article", "@id": "https://medtechterms.com/terms/mitre-attack#article", "headline": "ATT&CK, MITRE ATT&CK", "description": "Knowledge base of real-world adversary tactics, techniques, and procedures organized into a matrix used to model threats and assess defenses.", "url": "https://medtechterms.com/terms/mitre-attack", "mainEntityOfPage": { "@type": "WebPage", "@id": "https://medtechterms.com/terms/mitre-attack" }, "about": { "@id": "https://medtechterms.com/terms/mitre-attack#term" }, "articleSection": "Cybersecurity", "inLanguage": "en", "keywords": "MITRE ATT&CK, ATT&CK, Adversarial Tactics, Techniques & Common Knowledge, Cybersecurity, medical device, MedTech", "author": { "@type": "Person", "name": "Christian Espinosa", "jobTitle": "Founder, Blue Goat Cyber", "url": "https://bluegoatcyber.com" }, "publisher": { "@type": "Organization", "name": "MedTech Terms", "url": "https://medtechterms.com" }, "isPartOf": { "@type": "WebSite", "name": "MedTech Terms", "url": "https://medtechterms.com" }, "datePublished": "2026-06-20", "dateModified": "2026-06-20", "citation": [ { "@type": "CreativeWork", "name": "MITRE ATT&CK", "url": "https://attack.mitre.org/", "publisher": { "@type": "Organization", "name": "MITRE" } }, { "@type": "CreativeWork", "name": "ATT&CK for ICS", "url": "https://attack.mitre.org/matrices/ics/", "publisher": { "@type": "Organization", "name": "MITRE" } }, { "@type": "CreativeWork", "name": "Getting Started with ATT&CK", "url": "https://www.mitre.org/sites/default/files/2021-11/getting-started-with-attack-october-2019.pdf", "publisher": { "@type": "Organization", "name": "MITRE" } } ], "mentions": [ { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/mitre-d3fend#term", "name": "MITRE D3FEND", "alternateName": "D3FEND", "url": "https://medtechterms.com/terms/mitre-d3fend" }, { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/threat-modeling#term", "name": "Threat Modeling", "url": "https://medtechterms.com/terms/threat-modeling" }, { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/stride#term", "name": "STRIDE Threat Model", "alternateName": "STRIDE", "url": "https://medtechterms.com/terms/stride" }, { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/nist-csf#term", "name": "NIST Cybersecurity Framework", "alternateName": "NIST CSF", "url": "https://medtechterms.com/terms/nist-csf" }, { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/aami-tir57#term", "name": "AAMI TIR57", "url": "https://medtechterms.com/terms/aami-tir57" }, { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/premarket-cybersecurity#term", "name": "Premarket Cybersecurity Submission", "url": "https://medtechterms.com/terms/premarket-cybersecurity" } ] }, { "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://medtechterms.com/" }, { "@type": "ListItem", "position": 2, "name": "Terms", "item": "https://medtechterms.com/terms" }, { "@type": "ListItem", "position": 3, "name": "Cybersecurity", "item": "https://medtechterms.com/terms?cat=Cybersecurity" }, { "@type": "ListItem", "position": 4, "name": "MITRE ATT&CK", "item": "https://medtechterms.com/terms/mitre-attack" } ] }, { "@type": "FAQPage", "@id": "https://medtechterms.com/terms/mitre-attack#faq", "mainEntity": [ { "@type": "Question", "name": "How is ATT&CK different from the Cyber Kill Chain?", "acceptedAnswer": { "@type": "Answer", "text": "Lockheed Martin's Kill Chain is a seven-step linear model. ATT&CK is non-linear, far more granular (hundreds of techniques), and based on observed real-world behavior rather than a conceptual model." } }, { "@type": "Question", "name": "What is MITRE D3FEND?", "acceptedAnswer": { "@type": "Answer", "text": "D3FEND is MITRE's companion framework that catalogs defensive countermeasures and explicitly maps them to the ATT&CK techniques they mitigate. ATT&CK = offense; D3FEND = defense." } }, { "@type": "Question", "name": "Do I have to map every threat to ATT&CK?", "acceptedAnswer": { "@type": "Answer", "text": "Not formally. But mapping the credible threats from your threat model to specific ATT&CK techniques is the single most effective way to make a threat model auditable and testable." } } ] } ] } --- [ MedTech Terms The authoritative reference ](/) Browse Learn [Latest](/latest) About 1. [Home](/) 2. / 3. [Terms](/terms) 4. / 5. [Cybersecurity](/terms?cat=Cybersecurity) 6. / 7. MITRE ATT&CK [All terms](/terms) Cybersecurity [AI / ML in Devices](/ecosystems/ai-ml)[Connected & Cyber-Physical Devices](/ecosystems/connected-devices)[Clinical Evidence](/ecosystems/clinical-evidence)ATT&CK # MITRE ATT&CK Knowledge base of real-world adversary tactics, techniques, and procedures organized into a matrix used to model threats and assess defenses. Reviewed by [Christian Espinosa, Founder, Blue Goat Cyber](/authors/christian-espinosa) Last reviewed June 20, 2026 ## Definition MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) is a globally accessible framework that catalogs observed adversary behavior across the full attack lifecycle. It is organized as a matrix of tactics (the attacker's goal, e.g., Initial Access, Execution, Persistence, Lateral Movement, Exfiltration) and the specific techniques and sub-techniques attackers use to achieve each. ATT&CK is maintained by MITRE under government and community funding and is updated quarterly. Separate matrices exist for Enterprise, Mobile, ICS (Industrial Control Systems), and the mappings are widely used by SOCs, threat intel teams, red teams, and increasingly by medical device security teams. What the regulation says FDA's 2023 Premarket Cybersecurity guidance recommends manufacturers use a structured threat-modeling approach and cites ATT&CK alongside [STRIDE](/terms/stride) as accepted references. The Health Sector Coordinating Council Joint Security Plan ( [HSCC JSP](/terms/hscc-jsp)) recommends ATT&CK mapping in its [threat modeling](/terms/threat-modeling) chapter. [AAMI TIR57](/terms/aami-tir57) references ATT&CK as a knowledge source for identifying credible threats. ## What this means in practice For medical device manufacturers, ATT&CK is the lingua franca that connects [threat modeling](/terms/threat-modeling) to detection engineering and incident response. When you write a threat model ( [STRIDE](/terms/stride)\-based or otherwise) the next [step](/terms/step) is mapping each identified threat to specific ATT&CK techniques so your security controls, monitoring rules, and pen-test scope can be measured against real adversary behavior. ICS ATT&CK is particularly relevant for connected hospital devices that share characteristics with operational technology environments. Common pitfalls - • Mapping threats to ATT&CK tactics only (the column headers) instead of specific techniques and sub-techniques, the granularity is the point. - • Treating ATT&CK as a checklist of controls rather than a reference of attacker behavior, defensive frameworks like D3FEND or NIST CSF cover controls. - • Ignoring ICS ATT&CK for hospital-deployed devices; many techniques in that matrix apply to networked imaging, lab analyzers, and infusion fleets. ## Frequently asked questions How is ATT&CK different from the Cyber Kill Chain? Lockheed Martin's Kill Chain is a seven- [step](/terms/step) linear model. ATT&CK is non-linear, far more granular (hundreds of techniques), and based on observed real-world behavior rather than a conceptual model. What is MITRE D3FEND? Do I have to map every threat to ATT&CK? ## Related terms Grouped by theme ### Editor's picks · Hand-selected related concepts [ Cybersecurity AAMI TIR57 AAMI Technical Information Report providing MedTech-specific guidance on cybersecurity risk management. ](/terms/aami-tir57)[ Cybersecurity MITRE D3FEND(D3FEND) MITRE's knowledge graph of defensive cybersecurity countermeasures, explicitly mapped to the ATT&CK techniques they mitigate. ](/terms/mitre-d3fend)[ Cybersecurity NIST Cybersecurity Framework(NIST CSF) A risk-based framework of cybersecurity functions and outcomes published by NIST and widely used to organize MedTech security programs. ](/terms/nist-csf)[ Cybersecurity Premarket Cybersecurity Submission The bundle of cybersecurity artifacts a sponsor includes in a 510(k), De Novo, PMA, or HDE submission for a cyber device. ](/terms/premarket-cybersecurity) ### More in Cybersecurity · Same category [ Cybersecurity STRIDE Threat Model(STRIDE) A six-category framework for enumerating threats: Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege. ](/terms/stride)[ Cybersecurity Threat Modeling A structured analysis that identifies how an attacker could compromise a medical device and what controls mitigate each threat. ](/terms/threat-modeling)[ Cybersecurity AAMI SW96 AAMI/ANSI standard establishing requirements for medical-device cybersecurity activities throughout the lifecycle. ](/terms/aami-sw96)[ Cybersecurity AAMI TIR97(TIR97) AAMI Technical Information Report on post-market security risk management for medical device manufacturers, the operational companion to TIR57. ](/terms/aami-tir97) Cited by Where this term appears across MedTech Terms. Ecosystems (3) - [AI / ML in Devices](/ecosystems/ai-ml) - [Connected & Cyber-Physical Devices](/ecosystems/connected-devices) - [Clinical Evidence](/ecosystems/clinical-evidence) ## Primary references 3 sources Link health: 3 verified · last checked 2026-06-20 1. [1 MITRE ATT&CK Verified MITRE · attack.mitre.org ](https://attack.mitre.org/) 2. [2 ATT&CK for ICS Verified MITRE · attack.mitre.org ](https://attack.mitre.org/matrices/ics/) 3. [3 Getting Started with ATT&CK Verified MITRE · mitre.org ](https://www.mitre.org/sites/default/files/2021-11/getting-started-with-attack-october-2019.pdf) Inline markers like \[1\] jump to the matching reference above. Sponsor note ### Working on medical device cybersecurity? Blue Goat Cyber specializes in MedTech cybersecurity - threat modeling, SBOMs, penetration testing, and FDA premarket submissions. [Book a 30-minute discovery session](https://go.bluegoatcyber.com/meetings/blue-goat-cyber/discovery-session) - No obligation - Expert-led from minute one - NDA available on request MedTech Terms is a community resource sponsored by [Blue Goat Cyber](https://bluegoatcyber.com). Definitions are independent of any vendor. On this term Category Cybersecurity Acronym ATT&CK Sources 3 Updated 6/20/2026 [Compare with another term](/compare?a=mitre-attack) Learn in 60 seconds Card Lesson Quiz Knowledge base of real-world adversary tactics, techniques, and procedures organized into a matrix used to model threats and assess defenses. - · For medical device manufacturers, ATT&CK is the lingua franca that connects threat modeling to detection engineering and incident response. - · ICS ATT&CK is particularly relevant for connected hospital devices that share characteristics with operational technology environments. - · ATT&CK is maintained by MITRE under government and community funding and is updated quarterly. Remember this Watch out: Mapping threats to ATT&CK tactics only (the column headers) instead of specific techniques and sub-techniques, the granularity is the point. Related terms - [MITRE D3FEND(D3FEND) ](/terms/mitre-d3fend) - [Threat Modeling ](/terms/threat-modeling) - [STRIDE Threat Model(STRIDE) ](/terms/stride) - [NIST Cybersecurity Framework(NIST CSF) ](/terms/nist-csf) - [AAMI TIR57 ](/terms/aami-tir57) - [Premarket Cybersecurity Submission ](/terms/premarket-cybersecurity) You may also need Auto-suggested from Cybersecurity and shared keywords. - [CISA Known Exploited Vulnerabilities Catalog(KEV) ](/terms/kev) - [HSCC Joint Security Plan(HSCC JSP) ](/terms/hscc-jsp) - [LINDDUN ](/terms/linddun) - [Secure Product Development Framework(SPDF) ](/terms/spdf) - [Common Vulnerabilities and Exposures(CVE) ](/terms/cve) - [Common Vulnerability Scoring System(CVSS) ](/terms/cvss) [All Cybersecurity terms](/terms?cat=Cybersecurity) From the Blue Goat network Related resources and services on this topic. - [ MedTech Cybersecurity Standards Authoritative reference for the standards and guidances behind medical device cybersecurity. ](https://medtechcyberstandards.com) - [ MedTech Cyber Tips Practical, organized tips for medical device cybersecurity teams. ](https://medtechcybertips.com) - [ MedTech Cybersecurity Crosswalk International crosswalk of medical device cybersecurity requirements across regulators. ](https://mdccrosswalk.com) - [ Code Blue Real medical device cybersecurity incidents and their lessons. ](https://codebluechart.com) MedTech Terms An authoritative, plain-language reference for the regulatory, quality, cybersecurity, and software terms that shape modern medical devices. Browse - [All terms](/terms) - [A–Z index](/a-z) - [Categories](/categories) - [Ecosystems](/ecosystems) - [Learning paths](/paths) - [Compare terms](/compare) - [Quiz](/quiz) Resources - [FDA Medical Devices](https://www.fda.gov/medical-devices) - [EU MDR](https://eur-lex.europa.eu/eli/reg/2017/745/oj) - [IMDRF](https://www.imdrf.org/) - [Methodology](/methodology) - [Changelog](/changelog) - [Editor: Christian Espinosa](/authors/christian-espinosa) - [About this site](/about) © 2026 MedTech Terms. Reference content for educational purposes - not regulatory advice. A community resource sponsored by [Blue Goat Cyber](https://bluegoatcyber.com)