Threats: MITRE ATT&CK
How attackers operate, joined to the controls every OSA pattern is built from.
MITRE ATT&CK describes how attackers operate: the tactics they pursue, the techniques under each, the groups that use them, and the mitigations and detection strategies MITRE records against them. OSA joins it to NIST SP 800-53, the control catalogue behind every pattern, so that a technique leads to controls and controls lead to patterns.
Open the ATT&CK matrix →What it holds
- MITRE ATT&CK Enterprise v20.0 (2026-10-13), from MITRE's own STIX data: 15 tactics, 227 techniques and 479 sub-techniques, 178 groups, 44 mitigations and 703 detection strategies.
- The Center for Threat-Informed Defense's (CTID) mapping of NIST SP 800-53 Rev 5 to ATT&CK: 5,236 pairs of a control and a technique it mitigates, over 109 controls. CTID made it for ATT&CK 16.1; OSA carries it to v20.0 through MITRE's records of which techniques replaced which.
What the figures mean
466 of the 706 techniques and sub-techniques (66%) have at least one control in CTID's mapping. That says CTID related a control to the technique. It does not measure how well any organisation, or any OSA pattern, defends against it. CTID marks 96 techniques non-mappable, meaning no SP 800-53 control applies, and 144 are newer than its mapping or were left out of it. The matrix shows each as what it is, not as a gap. As MITRE puts it, covering techniques with ATT&CK does not guarantee full defensive coverage.
How to use it
- Open a technique in the matrix for its controls, MITRE's mitigations and detection strategies, the groups that use it, and the patterns that include the most of its controls.
- Choose a threat group to see the techniques MITRE records it using.
- From a pattern page, open the matrix filtered to that pattern's controls. From a control page, see the techniques the control mitigates.
- Programs and AI agents: the card at /attack.md, a card per technique such as /attack/t1566.md, and the API at /api/v1/attack/techniques/{id}.
Tactics
| Tactic | Techniques and sub-techniques | With a control |
|---|---|---|
| TA0043Reconnaissance | 46 | 7 |
| TA0042Resource Development | 51 | 0 |
| TA0001Initial Access | 22 | 20 |
| TA0002Execution | 66 | 55 |
| TA0003Persistence | 113 | 95 |
| TA0004Privilege Escalation | 96 | 81 |
| TA0005Stealth | 151 | 104 |
| TA0112Defense Impairment | 57 | 45 |
| TA0006Credential Access | 68 | 63 |
| TA0007Discovery | 49 | 15 |
| TA0008Lateral Movement | 23 | 22 |
| TA0009Collection | 41 | 27 |
| TA0011Command and Control | 45 | 39 |
| TA0010Exfiltration | 20 | 18 |
| TA0040Impact | 33 | 26 |
Sources and licences
- MITRE ATT&CK: © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Terms of use.
- CTID Mappings Explorer, SP 800-53 Rev 5 to ATT&CK 16.1 (updated 04/16/2025): © 2024 MITRE, Apache License 2.0.
- Both are generated into osa-data, data/mitre-attack, by a script that reads the published files. Its README lists the method and every change made.