Technique

A technique is the method an adversary uses to carry out a tactic. In ATT&CK, techniques turn abstract goals into concrete behaviours such as malicious script execution, token theft, or data exfiltration. They are useful because they map security findings to realistic attacker playbooks, not just control failures.

Expanded Definition

In cybersecurity, a technique is the concrete method used to accomplish an adversary objective, typically sitting below the tactic level in a threat framework. In MITRE ATT&CK, techniques describe observable behaviours such as credential dumping, process injection, or exfiltration over a command and control channel, while in AI security the same idea is applied more narrowly to adversarial methods that manipulate model behaviour or outputs. The term is useful because it bridges strategy and telemetry: a tactic explains the goal, while a technique explains how the goal is carried out in practice.

Definitions vary across frameworks when technique is used outside ATT&CK style knowledge bases, so practitioners should avoid treating it as a generic synonym for “attack” or “control gap.” A technique can be repeated across many intrusion paths, and one technique may support multiple tactics. For AI-related threats, the MITRE ATLAS adversarial AI threat matrix shows how adversarial methods are catalogued when the target is a model, pipeline, or agentic system rather than a conventional endpoint. The most common misapplication is using technique to describe a high-level campaign objective, which occurs when teams label a tactic or incident summary as if it were a specific attacker method.

Examples and Use Cases

Implementing technique-level analysis rigorously often introduces classification overhead, requiring organisations to balance richer detection context against the time needed to normalise event data correctly.

• Security analysts map endpoint alerts to specific ATT&CK techniques so a suspicious PowerShell event is treated as a repeatable method, not just an isolated alert.
• Threat hunters use techniques to group related activity across hosts, making it easier to spot the same method used with different payloads or user accounts.
• Incident responders document technique chains such as initial access, persistence, and exfiltration to reconstruct how the intruder progressed through the environment.
• AI security teams use the idea of technique to describe adversarial behaviours like prompt manipulation, model evasion, or data poisoning, especially when referencing MITRE ATLAS adversarial AI threat matrix.
• Detection engineers tag controls and detections to techniques so they can identify which attacker methods are covered and where coverage is weak.

Why It Matters for Security Teams

Technique is important because it turns abstract threat intelligence into operationally useful detection and response work. Without technique-level precision, teams can overstate coverage, miss repeated attacker behaviours, or build reports that describe intent without revealing execution. That matters in both conventional cyber defence and AI security, where the same goal can be achieved through very different methods depending on the environment, tool access, and trust boundaries.

For identity-heavy environments, technique also helps expose how adversaries move from stolen credentials to privileged access, token abuse, or agent misuse. That is especially relevant when non-human identities, API keys, or autonomous agents are in scope, because a technique often targets the mechanism of trust rather than the application itself. Frameworks such as MITRE ATLAS adversarial AI threat matrix reinforce the idea that defenders need method-level visibility, not just outcome-level summaries. Organisations typically encounter the operational significance of technique only after an intrusion is being reconstructed, at which point consistent technique mapping becomes unavoidable to explain what actually happened.

Related resources from NHI Mgmt Group

• How can organisations measure whether technique-level detection is working?
• Why do technique-based controls work better than payload filters for modern exploits?
• Why do technique-level detection scores often overstate real coverage?
• Why do attacker technique chains matter more than isolated alerts?