From small organizations to top 10 Fortune 500 companies, MITRE ATT&CK® is the global gold standard for turning cyber threat data into a strategic advantage.
Challenge
Anyone with a computer has the potential to cause damage from behind their screens; whether it’s the clichéd lone hacker in their parent’s basement or highly sophisticated nation-state actors attempting to disrupt the U.S. power grid.
Motives aside, the number of cyber attacks of all shapes, sizes, and impact is skyrocketing. They pose serious risks to national security, economic stability, public safety, and trust in essential services.
In 2023, the FBI received more than 800,000 reports of attacks, with potential losses estimated at $12.5 billion. The annual average cost of cybercrime is predicted to hit more than $23 trillion by 2027, according to studies by the International Monetary Fund.
As adversaries become increasingly sophisticated, keeping pace becomes exponentially more challenging. Picture “whack-a-mole”—a cybersecurity team barely getting a handle on one attack method before another pops up. Exhaustive defense efforts require time and resources that many organizations simply don’t have.
MITRE developed ATT&CK with the understanding that the complexities of cybersecurity are best confronted through collective effort, recognizing that national resilience is strengthened when organizations unite to share knowledge, adapt strategies, and respond effectively.
MITRE’s Solution—A United Front
ATT&CK is a living encyclopedia of cyber adversary tactics and techniques crowdsourced from an ever-growing global community of contributors.
As stewards of the framework and content, MITRE collects threat information, validates and organizes it, then shares it back to the public in a digestible, universally understood language. This comprehensive repository offers defenders a rubric for recognizing, responding to, and mitigating intrusions.
ATT&CK is free, easily accessible online, and regularly updated. It’s used in more than 190 countries on all seven continents.
Results—Knowledge is Power
ATT&CK provides a space for cyber defenders from all corners of the world to convene, collaborate, and exchange information about how and why bad actors break into their systems.
The resulting trove of knowledge promotes efficiency by teaching organizations how to optimize their resources and fill security gaps using tools they already have.
Before ATT&CK, cybersecurity teams lacked a consistent way to discuss and document adversary behaviors, which led to redundancies and miscommunications across the public and private sector, among organizations, and even among teams within organizations.
[ATT&CK] is the ‘motherbrain’ of cybersecurity planning and intelligence.
Connect
For more information about ATT&CK, get in touch with us today.
Industry Impact
It’s challenging to quantify the exact economic impact of ATT&CK because its value lies in proactive attack prevention. Considering the average cost of a data breach in the U.S. is $4.9 million, it’s estimated ATT&CK saves private companies and government agencies hundreds of millions of dollars each year. IBM recently calculated that even modest threat deterrence measures can reduce incident costs by up to 40%.
ATT&CK actively influences how the cybersecurity industry approaches threats. Dozens of cybersecurity vendors—from startups to major players in the marketplace— have built products and long-term strategies around ATT&CK. Consider this:
- Hundreds of cyber solutions companies, collectively generating more than $800 billion in revenue within the U.S. economy annually, have adopted ATT&CK in some form.
- The top 10 Fortune 500 companies, including Walmart, Amazon, Microsoft, and Google, rely on ATT&CK, either directly or through cyber tooling.
- More than 80% of North American organizations surveyed by an industry analyst in 2022 said ATT&CK is “critical” or “very important” for their security operations strategy.
- ATT&CK fluency is increasingly becoming a requirement for cyber jobs and a fundamental element of cyber education programs and curricula.
Resources
As the not-for-profit operator of federally funded R&D centers, our work catalyzes industry’s ability to meet critical national needs and fosters economic development.