What is the difference between CAPEC and CWE?

CWE (Common Weakness Enumeration) catalogues the underlying weaknesses in software and design. CAPEC (Common Attack Pattern Enumeration and Classification) catalogues the attacks that exploit those weaknesses. They are designed to be used together: a CAPEC pattern points to the CWE weaknesses it targets.

What is CAPEC used for?

CAPEC is used for threat modelling, secure software development, and penetration testing. It gives teams a shared, stable vocabulary of attack patterns so they can anticipate how adversaries will try to exploit a system and design defences and tests accordingly.

Which standards does Bidda crosswalk CAPEC to?

Bidda maps CAPEC attack patterns to the OWASP Application Security Verification Standard, the NIST Secure Software Development Framework, relevant ISO/IEC 27001 controls, and the linked CWE weaknesses, turning each attack pattern into concrete secure-development requirements.

MITRE CAPEC: A Dictionary of Attack Patterns

Common Attack Pattern Enumeration and Classification, linked to CWE weaknesses and secure-coding controls.

What CAPEC Catalogues

CAPEC stands for Common Attack Pattern Enumeration and Classification. It is a freely available dictionary of attack patterns maintained by MITRE, originally sponsored by the United States Department of Homeland Security. An attack pattern is a generalised description of how an adversary exploits a known type of weakness: the prerequisites, the steps, the skills required, and the consequences. Each pattern carries a stable identifier, such as CAPEC-66 for SQL Injection, CAPEC-100 for Buffer Overflow, or CAPEC-103 for Clickjacking.

How CAPEC Is Organised

CAPEC classifies attack patterns along two main views. The Mechanisms of Attack view groups patterns by the method used, such as injection, abuse of functionality, or manipulation of data structures. The Domains of Attack view groups them by the area targeted, such as software, hardware, communications, or the supply chain. This dual structure lets a practitioner approach the catalogue from either the technique or the target.

The CWE Connection

CAPEC is designed to work hand in hand with the Common Weakness Enumeration. CWE catalogues the underlying weaknesses in code and design; CAPEC catalogues the attacks that exploit them. A buffer overflow attack pattern in CAPEC points to the specific CWE weaknesses that make it possible. For a development team, this pairing answers two questions at once: what could go wrong in the code, and how would an attacker take advantage of it.

How Bidda Maps CAPEC

Bidda represents CAPEC attack patterns as verified nodes and crosswalks them to the standards that govern secure development and verification: the OWASP Application Security Verification Standard, the NIST Secure Software Development Framework, and the relevant ISO/IEC 27001 controls, alongside the linked CWE weaknesses. An attack pattern such as SQL injection therefore resolves to the input-validation and testing requirements that a secure-development programme must demonstrate.

From Threat Model to Test Plan

Because each CAPEC node carries its crosswalk and dependency context, a security engineer can build a threat model from the relevant attack patterns and convert it directly into verification requirements and test cases. Agents can query the same nodes through the Bidda MCP server and discovery API, mapping an attack pattern to its weaknesses and controls automatically. The official CAPEC catalogue is published by MITRE at capec.mitre.org.