MITRE ATT&CK is a publicly available, continuously updated knowledge base of adversary tactics and techniques, built from real, observed attacks rather than theoretical categories. Where STRIDE gives you six abstract threat categories to reason from, ATT&CK gives you a catalog of what attackers have actually, specifically done.
Quick definition: MITRE ATT&CK is a matrix of adversary Tactics (the attacker's goal at a given stage, e.g. "Initial Access") and Techniques (the specific method used to achieve it, e.g. "Phishing"), maintained by the MITRE Corporation from real-world threat intelligence.
Tactics vs. techniques
ATT&CK organises the attack lifecycle into tactics — the "why" at each stage, such as Reconnaissance, Initial Access, Execution, Privilege Escalation, Lateral Movement, and Exfiltration. Under each tactic sit dozens of techniques — the "how": specific, named methods like T1566 (Phishing) under Initial Access, or T1078 (Valid Accounts) under both Initial Access and Privilege Escalation. Many techniques have documented sub-techniques going a level more specific still.
Every technique in the matrix is backed by public references to real incidents or threat-intel reporting where it was observed — this is the core difference from a theoretical framework: ATT&CK describes what has actually happened, and gets updated as adversary behavior evolves.
How it's used in practice
- Red teams and penetration testers use ATT&CK technique IDs to scope and report engagements in a standard vocabulary defenders already understand.
- Detection engineering teams map their SIEM/EDR alert coverage against the matrix to find gaps — "we have no detection for any Lateral Movement technique."
- Threat modeling uses ATT&CK to make attack-tree leaf nodes concrete: instead of a vague leaf like "attacker moves laterally," you tag it with the specific ATT&CK technique(s) that apply, which pulls in real-world context about how common and how detectable that technique actually is.
ATT&CK vs. STRIDE: different jobs
These aren't competing frameworks — they answer different questions at different points in the process. STRIDE is a design-time tool: applied to a Data Flow Diagram before or during development, it asks "what categories of thing could go wrong with this element?" It's abstract and category-based on purpose, so it works even for a system that doesn't exist yet.
ATT&CK is grounded in observed reality: it's most valuable once you have concrete attack paths to map against it — exactly what an attack tree's leaf nodes give you. A common, effective combination: use STRIDE against your DFD to find threat categories broadly, build an attack tree for the serious ones, then tag each leaf node with the specific ATT&CK technique it corresponds to — turning an abstract threat into something grounded in documented, real-world adversary behavior.