---
title: What is ATT&CK and How Can It Protect Your Business from Cyber Threats
description: Learn exactly what ATT&CK framework is and how this security model can help to protect your business from costly cyber attacks.
---

[Mitnick Security Blog - Cybersecurity News and Articles ](https://www.mitnicksecurity.com/blog)

# [What is ATT&CK and How Can It Protect Your Business from Cyber Threats](https://www.mitnicksecurity.com/blog/what-is-attack-and-how-can-it-protect-your-business-from-cyber-threats)

 Written by [Mitnick Security](https://www.mitnicksecurity.com/blog/author/mitnick-security) | Aug 4, 2020 5:15:00 PM

In the cybersecurity community, there always seems to be a new acronym to learn. [ATT&CK](https://www.mitre.org/sites/default/files/publications/mitre-getting-started-with-attack-october-2019.pdf), however, has been a well-respected model that many professionals have stood behind for years.

Because this is such an important concept in the cybersecurity landscape, we wanted to explain exactly what the framework is, and educate you on how this security model can help to protect your business from costly cyber attacks.

## What is ATT&CK?

Don’t you wish you could get into the mind of a hacker? What if you could understand the exact path their mind takes from the conception of an attack to breaking into your systems? Unless you’re a cybersecurity expert, you probably didn’t even realize the cyber attack lifecycle consists of seven separate stages, with further steps within each.

In the cybersecurity community, many security safeguards focus nearly exclusively on the first four phases of the life cycle: recon, weaponize, deliver, and exploit. **But there is an entire set of phases that happen after the attacker gets in,** including ways the bad actor controls your device and systems, how they execute further infiltration, and how they maintain reach by gaining deep access or:

- Control
- Execute
- Maintain

 

**The ATT&CK model focuses on the behaviors and actions an attacker may take post-exploit. This allows us to understand tactics and techniques that indicate an attack is in progress and catch it early on.**

Why are these post-exploit stages so important? [According to M-Trends](https://www.youtube.com/watch?v=P0F_BIgUh9U&feature=youtu.be), the median number of days an adversary will sit inside a network undetected is an incredible 146 days. That’s a long time for a hacker to tinker around in your backend, uncovering complex insights and wealths of data all behind the curtain. By focusing on the last stages of the cyber attack lifecycles, companies can detect these idle threats far before they become not-so-idle!

## The ATT&CK Framework

The ATT&CK acronym stands for:

- **&**

- **C**ommon
- **K**nowledge

 

MITRE developed a knowledge base of adversary tactics and techniques **based on real-world observations of cyberattacks. **MITRE compiled this massive database by— you guessed it!— digging through data themselves and finding commonalities and patterns. They scoured through a large set of publicly available threat reports and analyses and used a Red Team to test and refine their model. 

In the end, they discovered 10 high level tactics within the three post-exploit phases (control, execute, and maintain) that adversaries try to achieve once they get into a network:

1. Execution
2. Persistence
3. Privilege Escalation
4. Defense Evasion
5. Credential Access
6. Discovery
7. Lateral Movement
8. Collection
9. Exfiltration
10. Command and Control

The fact that these tactics are supported by real-life analysis, makes them crucial patterns to understand— essentially, the top attack paths and behaviors bad actors will take to compromise your business. And it’s why cybersecurity experts use this database to plan for possible attack patterns.

## The Advantages of Using ATT&CK

There are a number of ways the ATT&CK model could serve your business’s security posture, but here are some key advantages:

## How Prepared are You for an Attack?

With today’s threat landscape constantly evolving, it’s important to understand the behaviors and attack paths of adversaries, and to stay-up-to-date on new threat prevention tactics.

**Do you know how well your team would handle social engineering attempts posed by a malicious hacker? **Put your employees to the test with [Social Engineering Strength Testing](https://www.mitnicksecurity.com/social-engineering-strength-testing) or [Security Awareness Training](https://www.mitnicksecurity.com/kevin-mitnick-security-awareness-training) from Kevin Mitnick and his Global Ghost Team.

[View full post](https://www.mitnicksecurity.com/blog/what-is-attack-and-how-can-it-protect-your-business-from-cyber-threats)

```json
{
  "@context" : "http://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "Mitnick Security"
  },
  "dateModified" : "2020-09-26T13:53:36.354Z",
  "datePublished" : "2020-08-04T17:15:00Z",
  "headline" : "What is ATT&CK and How Can It Protect Your Business from Cyber Threats",
  "image" : {
    "@type" : "ImageObject",
    "height" : 688,
    "url" : "https://f.hubspotusercontent20.net/hubfs/3875471/what-is-att&ck.jpeg",
    "width" : 1000
  },
  "mainEntityOfPage" : "https://www.mitnicksecurity.com/blog/what-is-attack-and-how-can-it-protect-your-business-from-cyber-threats",
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "height" : 60,
      "url" : "/hs/hsstatic/content_shared_assets/static-1.4092/img/default-amp-logo.png",
      "width" : 60
    },
    "name" : "Mitnick Security Blog"
  }
}
```