What is the difference between a tactic and a technique in ATT&CK?

A tactic is the adversary's goal, such as Persistence or Exfiltration. A technique is the specific method used to achieve that goal, such as OS Credential Dumping (T1003). Sub-techniques describe a technique more precisely. Tactics answer why, techniques answer how.

Is MITRE ATT&CK free to use?

Yes. ATT&CK is published openly by MITRE and is free to access at attack.mitre.org. Bidda adds a verified crosswalk layer that maps each technique to NIST 800-53, ISO 27001, PCI DSS, and other control frameworks, and exposes it through an API and MCP server.

How does ATT&CK relate to compliance frameworks like NIST and ISO 27001?

ATT&CK describes attacker behaviour, while frameworks like NIST 800-53 and ISO 27001 describe defensive controls. Bidda crosswalks the two so that a given technique resolves directly to the controls that mitigate it, turning threat intelligence into auditable compliance evidence.

MITRE ATT&CK Enterprise, Explained for Compliance Teams |…

The 14-tactic adversary playbook, crosswalked to NIST, ISO 27001, and PCI DSS.

What MITRE ATT&CK Enterprise Is

ATT&CK stands for Adversarial Tactics, Techniques, and Common Knowledge. It is a free, openly published knowledge base maintained by MITRE that documents how real adversaries behave once they are inside, or trying to get inside, an enterprise environment. Unlike a vulnerability list, ATT&CK describes behaviour: the goals an attacker pursues and the concrete methods they use to achieve them. The Enterprise matrix spans Windows, macOS, Linux, cloud platforms (IaaS, SaaS, identity providers, and office suites), network devices, and containers.

Tactics, Techniques, and Sub-techniques

ATT&CK is structured in three layers. Tactics are the adversary's tactical goals, the "why" of an action. Techniques are the "how": the specific methods used to achieve a goal. Sub-techniques are more precise descriptions of a technique. Every technique carries a stable identifier, such as T1003 for OS Credential Dumping or T1082 for System Information Discovery, which lets tools and teams reference the same behaviour unambiguously.

The 14 Enterprise Tactics

The Enterprise matrix is organised into 14 tactics that follow the arc of an intrusion: Reconnaissance, Resource Development, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration, and Impact. Reading left to right approximates how an operation unfolds, though real adversaries move through tactics in whatever order suits their objective.

Why It Matters for Defenders

ATT&CK gives blue teams, detection engineers, and SOC leaders a shared language for measuring coverage. Instead of asking "are we secure," a team can ask "which techniques can we detect, and where are the gaps." This is the foundation of threat-informed defence: prioritising detection and hardening against the techniques most relevant to your threat profile, and validating those defences through red and purple team exercises that are themselves mapped to ATT&CK.

How Bidda Maps ATT&CK Enterprise

Bidda represents ATT&CK techniques as deterministic compliance nodes. Each node distils the technique into a Bottom Line Up Front summary, a step-by-step workflow, and a structured schema an agent can query directly. Crucially, every technique node is crosswalked to the control frameworks that auditors and regulators test against: NIST SP 800-53, the NIST Cybersecurity Framework, ISO/IEC 27001, PCI DSS, and sector regimes such as NIS2 and DORA. That mapping is what closes the loop between a detected adversary behaviour and the specific control obligation that addresses it.

Querying It Programmatically

The same mapping is available to autonomous agents. The Bidda MCP server exposes a get_mitre_mapping tool that accepts a technique identifier and returns the cross-framework view, while the discovery API lets an agent retrieve technique nodes and follow their dependencies to build a full control picture. The official matrix is published by MITRE at attack.mitre.org; Bidda adds the verified crosswalk layer on top.

From Technique to Obligation

The value of treating ATT&CK as machine-executable intelligence is speed and defensibility. When an analyst sees credential dumping in an alert, a single lookup returns the relevant NIST and ISO controls, the prerequisite defensive measures, and a citation trail back to primary sources. That is the difference between knowing an attacker technique exists and being able to prove, to an auditor, that you have a control mapped against it.

MITRE ATT&CK Enterprise, Explained for Compliance Teams