MITRE D3FEND
MITRE's knowledge graph of defensive cybersecurity countermeasures, explicitly mapped to the ATT&CK techniques they mitigate.
Definition
D3FEND is a MITRE knowledge graph of defensive cybersecurity techniques organized under Model, Harden, Detect, Isolate, Deceive, Evict and Restore. It models relationships among defensive techniques, digital artifacts and offensive techniques to support defensive analysis. A mapped relationship is not proof that a particular implementation defeats an attack.What this means in practice
For MedTech, D3FEND lets you justify a control library against the threats in your threat model. If your model identifies T1190 (Exploit Public-Facing Application) as a credible threat, D3FEND points you to specific defensive techniques (Application Hardening, Network Traffic Filtering, Process Spawn Analysis) and connects each to measurable design elements that can appear in your security architecture, IEC 81001-5-1 conformance evidence, or premarket cybersecurity submission.Examples
- Illustrative: A MedTech manufacturer uses D3FEND to select and document defensive controls that mitigate specific ATT&CK techniques identified in their medical device threat model.
- Illustrative: During a premarket cybersecurity submission, an organization demonstrates how its chosen security architecture aligns with D3FEND techniques to counter common MedTech attack patterns.
- Illustrative: A hospital uses D3FEND to describe segmentation and application-control techniques, then tests their effectiveness against selected attack paths.
- •Treating D3FEND as a control catalog and ignoring its ontology, the value is in the typed relationships between artifact, technique, and digital effect.
- •Mapping controls to D3FEND in isolation without first mapping threats to ATT&CK, the bridge breaks both ways.
- •Expecting 1:1 coverage, many ATT&CK techniques have multiple D3FEND counters, and some have none.
Frequently asked questions
Related terms
Grouped by themeEditor's picks
· Hand-selected related conceptsInternational standard defining secure-product-lifecycle activities for health software, including medical devices.
Knowledge base of real-world adversary tactics, techniques, and procedures organized into a matrix used to model threats and assess defenses.
A risk-based framework of cybersecurity functions and outcomes published by NIST and widely used to organize MedTech security programs.
A structured analysis that identifies how an attacker could compromise a medical device and what controls mitigate each threat.
More in Cybersecurity
· Same categoryAAMI/ANSI standard establishing requirements for medical-device cybersecurity activities throughout the lifecycle.
AAMI Technical Information Report providing MedTech-specific guidance on cybersecurity risk management.
AAMI Technical Information Report on post-market security risk management for medical device manufacturers, the operational companion to TIR57.
Unauthorized remote control of an implanted neurostimulator (e.g., DBS) to alter stimulation parameters and harm a patient.
Where this term appears across MedTech Terms.
Latest in MedTech
Sources
5 sourcesSources support the definition or relevant regulatory context, not necessarily every claim on this page. Each is graded against our source-tier hierarchy so you can see what rests on binding law versus commentary.
Official-source claim check:
MITRE D3FEND is a defensive-technique knowledge graph; relationships support analysis rather than guaranteeing mitigation.
Partial review: verified corrections are applied, but this is not a full accuracy certification. The last full review date is unchanged.
Remaining verification limits
- Secondary regulatory, standards-clause, market-prevalence or procurement claims were not fully substantiated by accessible original text.
- 1MITRE D3FENDTier 2 VerifiedMITREd3fend.mitre.org
- 2D3FEND ATT&CK mappingsTier 2 VerifiedMITREd3fend.mitre.org
- 3HSCC - Health Sector Coordinating CouncilTier 4 VerifiedHSCChealthsectorcouncil.org
- 4MITRE Model tacticTier 2 UncheckedMITREd3fend.mitre.org
- 5MITRE Restore tacticTier 2 UncheckedMITREd3fend.mitre.org
Inline markers like [1] jump to the matching reference above.