MITRE ATT&CK Framework: A Practical Guide

The MITRE ATT&CK framework is a free, publicly available knowledge base that catalogs the tactics, techniques, and procedures (TTPs) real attackers use, organized into 14 tactics and more than 270 documented techniques. MITRE Corporation, a federally funded research and development center, created the framework in 2013 to document how well defenders detect the behavior attackers actually use. ATT&CK stands for Adversarial Tactics, Techniques, and Common Knowledge, and it has become the standard reference for describing how intrusions unfold, from reconnaissance and phishing through ransomware deployment.

For small and midsize businesses, MITRE ATT&CK works less like a compliance checklist and more like a map of attacker behavior. Instead of vague advice to improve security, it names the exact technique, such as T1566 (Phishing) or T1078 (Valid Accounts), and points to the control that mitigates it. That specificity matters for tax firms managing IRS Publication 4557 WISP obligations and healthcare practices meeting the HIPAA Security Rule, since it turns a vague risk assessment requirement into a documented, auditable list of what your controls cover.

Small businesses face the same attack techniques as large enterprises, without the budget or staff to match. Attackers automate their targeting, so a 10-person tax firm sees the same phishing kits and credential-stuffing tools used against Fortune 500 companies. MITRE ATT&CK closes that gap by giving any business, at no cost, the same behavioral intelligence security vendors and government analysts use.

Businesses relying only on traditional antivirus typically cover a small fraction of high-priority ATT&CK techniques. Adding endpoint detection and response (EDR), email security, and multi-factor authentication (MFA) raises that coverage substantially, because each control addresses techniques across several tactics rather than a single attack type.

The framework also strengthens compliance documentation. Tax professionals building a Written Information Security Plan under IRS Publication 4557 can cite specific ATT&CK technique IDs as evidence of a documented risk assessment. Healthcare practices can map HIPAA Security Rule technical safeguards under 45 CFR 164.312 to specific techniques, giving auditors and cyber insurers an objective way to evaluate what your controls address.

ATT&CK organizes attacker behavior into two layers: tactics, the objective at each stage of an attack, and techniques, the specific method used to reach it. Each technique carries a unique ID, like T1566 for Phishing or T1059.001 for PowerShell execution, so security teams, vendors, and threat intel sources can all reference the same behavior.

MITRE maintains three matrices. The Enterprise Matrix covers Windows, macOS, Linux, cloud platforms, and network infrastructure, and is the one most small businesses should focus on. The Mobile Matrix documents iOS and Android-specific techniques, and the ICS Matrix addresses industrial control systems. Cloud-native businesses should note that cloud attacks often abuse legitimate platform features, like Azure AD permissions or AWS IAM policies, rather than malware, which is why identity and access controls matter as much as endpoint protection in the cloud.

Each tactic marks a distinct phase of an intrusion. Attackers don't always move through them in order, sophisticated actors skip stages or double back, but defense-in-depth across all 14 phases catches more intrusions than hardening any single stage.

Before buying anything new, a gap analysis shows which techniques your current tools already cover and where the holes are. Most small businesses find their biggest gaps in Credential Access, Lateral Movement, and Exfiltration, the three tactics where traditional antivirus provides the least coverage.

Start by listing every control you have: antivirus, firewall, email filtering, backups, MFA, and patch management, then note which technique each one addresses. Email filtering with anti-phishing detection covers T1566; EDR typically covers T1059.001, T1003, and T1055. MITRE's free ATT&CK Navigator lets you build a visual heatmap of your coverage and export it to share with a vendor or auditor. The 2025 Verizon Data Breach Investigations Report is a useful reference for which techniques are most active in your industry right now.

Tax and accounting firms should prioritize T1566 (Phishing), T1078 (Valid Accounts), T1486 (Data Encrypted for Impact), and T1490 (Inhibit System Recovery). Healthcare organizations should also weigh T1133 (External Remote Services) and T1005 (Data from Local System) given HIPAA's focus on electronic protected health information access controls. For more on closing the patching gap specifically, see our guide to patch management.

Closing ATT&CK coverage gaps doesn't require an enterprise budget, but the controls you add should match how many endpoints and how much regulated data you're protecting. As a general planning range, foundational coverage, email security, EDR, MFA, and immutable backup, typically runs $200-$500 a month for a 5-25 person office, based on common per-user and per-endpoint software pricing. Adding managed detection and response (MDR) and DNS filtering for continuous monitoring usually moves that to $500-$1,200 a month for larger offices. These are ranges to plan against, not quotes: actual pricing depends on vendor, endpoint count, and contract terms, so confirm current numbers directly with any vendor you evaluate. For a closer look at how EDR, identity protection, and bundled pricing compare, see our breakdown of vendor pricing bundles, and our ransomware protection guide for backup and recovery specifics.

MITRE and the security community publish extensive free resources so small businesses can put ATT&CK to work without a dedicated security team. The ATT&CK website hosts the full technique catalog with detection and mitigation guidance for every entry. ATT&CK Navigator is a free browser tool for building coverage heatmaps you can export for vendors or auditors. MITRE also publishes ATT&CK Workbench, a desktop tool for organizations that want to customize the framework around their own environment and local threat intelligence.