MITRE ATT&CK Framework: A Practical Guide

MITRE ATT&CK is a free, public knowledge base that documents how real attackers operate, organized into 14 tactics and more than 270 documented techniques across enterprise, mobile, and industrial control system environments. MITRE Corporation, a federally funded research and development center, built the framework in 2013 to track how well defenders detect the behavior attackers actually use. The name stands for Adversarial Tactics, Techniques, and Common Knowledge, and it has become the standard reference security teams use to describe how an intrusion unfolds, from reconnaissance through ransomware deployment.

For small and midsize businesses, MITRE ATT&CK works less like a compliance checklist and more like a map of attacker behavior. Instead of vague advice to improve security, it names the exact technique, such as T1566 (Phishing) or T1078 (Valid Accounts), and points to the control that mitigates it. That specificity matters for tax firms managing IRS Publication 4557 WISP obligations and healthcare practices meeting the HIPAA Security Rule, since it turns a vague risk assessment requirement into a documented, auditable list of what your controls cover.

Small businesses aren't too small to be targeted. Attackers automate their targeting, so a 10-person tax firm sees the same phishing kits and credential-stuffing tools used against Fortune 500 companies. MITRE ATT&CK closes that intelligence gap by giving any business, at no cost, the same behavioral data that security vendors and government analysts use.

According to IBM's Cost of a Data Breach Report, compromised credentials are involved in 19% of breaches, the most common initial attack vector. That single statistic explains why MFA shows up as the top mitigation for several ATT&CK tactics below.

ATT&CK organizes attacker behavior into two layers. A tactic is the adversary's objective at a given stage of an attack; a technique is the specific method used to reach it. Each technique carries a unique ID, such as T1566 for phishing or T1059.001 for PowerShell execution, so analysts, vendors, and threat intel sources can all reference the same behavior.

MITRE maintains three matrices. The Enterprise Matrix covers Windows, macOS, Linux, cloud platforms, and network infrastructure, and is the one most small businesses should focus on. The Mobile Matrix documents iOS and Android-specific techniques, and the ICS Matrix addresses industrial control systems. Cloud-hosted businesses should note that cloud attacks often abuse legitimate platform features, such as Azure AD permissions or AWS IAM policies, rather than malware, which is why identity and access controls matter as much as endpoint protection in the cloud.

Each tactic marks a distinct phase of an intrusion. Attackers don't always move through them in strict order, sophisticated actors skip stages or double back, but defense-in-depth across all 14 phases catches more intrusions than hardening any single stage.

Before buying anything new, a gap analysis shows which techniques your current tools already cover and where the holes are. Most small businesses find their biggest gaps in Credential Access, Lateral Movement, and Exfiltration, the three tactics where traditional antivirus provides the least coverage.

List every control you have, antivirus, firewall, email filtering, backups, MFA, and patch management, then note which technique each one addresses. Email filtering with anti-phishing detection covers T1566; EDR typically covers T1059.001, T1003, and T1055. The free ATT&CK Navigator lets you build a visual heatmap of your coverage and export it to share with a vendor or auditor. For more on closing the patching gap specifically, see our guide to patch management.

Tax and accounting firms should prioritize T1566 (Phishing), T1078 (Valid Accounts), T1486 (Data Encrypted for Impact), and T1490 (Inhibit System Recovery). Healthcare organizations should also weigh T1133 (External Remote Services) and T1005 (Data from Local System), given the HIPAA Security Rule's focus on access controls for electronic protected health information.

Closing ATT&CK coverage gaps doesn't require an enterprise budget, but the controls you add should match how many endpoints and how much regulated data you're protecting. As a general planning range, foundational coverage, email security, EDR, and MFA, plus immutable backup, typically runs $200-$500 a month for a 5-25 person office in 2026, based on common per-user and per-endpoint software pricing. Adding managed detection and response (MDR) and DNS filtering for continuous monitoring usually moves that to $500-$1,200 a month for larger offices. These are ranges to plan against, not quotes: actual pricing depends on vendor, endpoint count, and contract terms, so confirm current numbers directly with any vendor you evaluate.

For a closer look at how EDR, identity protection, and bundled pricing compare across vendors, see our breakdown of vendor pricing bundles.

MITRE and the security community publish free resources so small businesses can use ATT&CK without a dedicated security team. The ATT&CK website hosts the full technique catalog with detection and mitigation guidance for every entry. ATT&CK Navigator is a free browser tool for building coverage heatmaps you can export for vendors or auditors. MITRE also publishes ATT&CK Workbench, a desktop tool for organizations that want to customize the framework around their own environment and local threat intelligence.