OSA's ATT&CK matrix now runs on MITRE ATT&CK Enterprise v20.0, released on 13 October, joined to NIST SP 800-53 through the Center for Threat-Informed Defense's (CTID) published mapping. We rebuilt it from MITRE's and CTID's own data, it now works on a phone, and the page is a tenth of its old size. Version 1.3 of the OSA API gives agents the same data in a request or two, and we've added the EU AI Act and moved more of our framework mappings onto published crosswalks.
Why it matters
ATT&CK is how most security teams describe what attackers do, and SP 800-53 is the control catalogue behind every OSA pattern. With the two joined you can start from a technique you're worried about, find the controls that mitigate it, and then the patterns that put those controls to work. An agent can now make that journey as easily as a person.
What's new in the matrix
- The matrix covers every Enterprise technique and sub-technique in v20, 706 in all, across 15 tactics including the new Stealth and Defense Impairment.
- Open a technique to see its SP 800-53 controls, MITRE's mitigations and detection strategies, the threat groups MITRE records using it, and the OSA patterns that include the most of its controls.
- Choose a threat group to isolate its techniques, or open the matrix from any pattern page to see where that pattern's controls apply.
- On a phone each tactic opens as a list. On a larger screen the tactic headings stay in view as you scroll.
- A new Foundations page sets out the sources and what each figure means.
For agents: API 1.3
- A card for the matrix at /attack.md, and one for every technique, such as /attack/t1566.md for phishing.
/api/v1/attack/techniques/{id}returns a technique with its controls, MITRE's mitigations and detection strategies, the groups that use it, and the patterns ranked by how many of its controls they include./api/v1/controls/{id}?fields=attackgoes the other way, from a control to the techniques it mitigates.- llms.txt, the OpenAPI description and the agent skill describe the new routes.
What we measured
466 of the 706 techniques and sub-techniques have at least one SP 800-53 control in CTID's mapping, which is 66%. The figure describes the mapping: CTID relates at least one control to each of those techniques. CTID marks a further 96 techniques as having no applicable SP 800-53 control, and the matrix shows those as a state of their own.
CTID's newest mapping is for ATT&CK 16.1, so we carried it forward to v20 using MITRE's own records of which techniques replaced which. 5,263 of its 5,264 control and technique pairs carried across.
The matrix page fell from 2.4 MB to 235 KB, with the detail for each technique now in a separate file. A control's answer from the API is leaner too. SI-04, which CTID maps to more techniques than any other control, went from 161 KB to 20 KB now that its 373 techniques have a route of their own.
New and stronger mappings
- The EU AI Act, as amended by this year's Digital Omnibus, is mapped to SP 800-53: 52 obligations, each with its date of application. OSA now maps 90 frameworks.
- The NIST AI RMF is mapped across all 72 of its subcategories, from NIST's own text.
- HIPAA and NERC CIP now take NIST's registered crosswalks as their base, as ISO 27001 and CSF 2.0 already do. HIPAA has 504 control-to-clause pairs and NERC CIP 328, with OSA's own additions labelled as ours.
- NERC CIP names the versions in force in the United States, and records the next approved version of each standard.
- Each framework's clauses appear in its own order, and CSF 2.0 uses NIST's final titles.
Try it
Start at the ATT&CK matrix, or point your agent at /llms.txt. If you spot a mapping that differs from its source, please raise an issue with what OSA says and what the source says. OSA's patterns and mappings remain free under CC BY-SA 4.0. ATT&CK is © 2026 The MITRE Corporation, reproduced and distributed with its permission, and CTID's mapping is published under the Apache License 2.0.
Russell Wing, co-founder, Open Security Architecture