This is a layered classification model for describing AI attacks from broad strategy down to the exact input. Techniques generalise recurring methods, tactics group related techniques, and prompts are the concrete evidence. The structure helps teams analyse patterns without losing the details needed for detection and mitigation.
Expanded Definition
Tactics, techniques, and prompts form a layered way to describe AI attacks from the highest-level objective down to the exact input used. In practice, the model is useful because it separates intent from method and preserves the artefact that can be investigated, replayed, or blocked.
The boundary matters. A tactic describes the attacker goal, such as steering a model toward harmful behaviour or extracting sensitive context. A technique is the repeatable method used to pursue that goal. A prompt is the concrete instruction, query, or text sequence that serves as evidence of how the technique was applied. The term is closest to adversary classification language used in threat intelligence, but it is adapted to AI systems where the prompt itself can be the observable payload. This is a recognised pattern rather than a settled universal standard, so teams should treat the wording as a practical analysis model, not a formal taxonomy.
For readers comparing AI threat models, the closest external reference is the MITRE ATLAS adversarial AI threat matrix, which organises adversary behaviour around AI-specific tactics and techniques.
Examples and Use Cases
Security teams use this model when they need to turn scattered AI misuse into patterns that can be detected and governed. It is especially helpful when logs, red-team findings, and user-reported prompts all need to be normalised into one shared vocabulary.
- A prompt injection attempt is recorded as the prompt, while the broader tactic may be to override system instructions or redirect tool use.
- A malicious retrieval query may look like a single prompt, but the technique is repeated probing for hidden context across sessions.
- A jailbreaking campaign can reuse different prompts while following one technique that aims to bypass safety boundaries.
- An analyst can group multiple prompts into one tactic when they all serve the same objective, such as data exfiltration from an agent workflow.
- A red-team report can preserve exact prompts as evidence while mapping them to higher-level techniques for reporting and comparison.
The trade-off is analytical precision versus operational simplicity. Finer classification improves pattern recognition, but overly granular labels can make triage slower if teams do not agree on naming and evidence standards.
For behaviour-oriented mapping of adversary methods across systems, the MITRE ATT&CK Enterprise Matrix remains a useful parallel reference, even though it is not AI-specific.
Security Implications
Misclassifying these layers weakens both detection and response. If teams treat a prompt as the whole threat, they may miss the underlying technique and fail to recognise repeated abuse across multiple inputs. If they only classify the tactic, they lose the concrete evidence needed to tune filters, reproduce the issue, or brief incident responders.
That gap can leave defenders with shallow alerting, inconsistent severity ratings, and poor trend analysis. It also creates governance problems because one team may call something a one-off user prompt while another sees a recurring abuse pattern. In AI security work, the same visible prompt can be part of several different techniques, so analysts need to preserve context rather than rely on a single label.
Practitioner observation matters here: the prompt is often the most actionable artefact, but it is rarely the full story. Good case handling keeps the exact text, the surrounding conversation, and the system behaviour together so the classification can support both review and mitigation.
Domain and Governance Relevance
This term sits at the boundary between AI security and threat intelligence. It helps teams govern how AI misuse is described, compared, and escalated across red teaming, monitoring, and model operations. For agentic systems, the relevance is even stronger because prompts can drive tool use, workflow branching, or data access, so a single input may have downstream effects beyond the chat surface.
That changes governance in a practical way. Teams need a shared classification language that distinguishes intent, method, and evidence so incidents are not collapsed into vague “bad prompts” reporting. For NHI-adjacent environments, this is especially important where an agent, service account, or connected tool executes actions based on a prompt, because the security question is no longer only what was said but what authority the input could trigger.
The governance value is therefore not just consistency. It is the ability to connect observed AI behaviour to accountability, detection logic, and response thresholds without losing the artefact that explains how the abuse happened.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATLAS, OWASP Agentic AI Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST AI RMF set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATLAS | ATLAS Tactic and Technique taxonomy — Adversarial AI Tactics and Techniques | Directly matches AI attack classification from tactic to technique. |
| Recommendation — Map observed AI abuse to ATLAS tactics and techniques to standardise detection and reporting. | ||
| OWASP Agentic AI Top 10 | A3 — Prompt Injection | Covers prompt-driven attacks that use the input as the exploit vehicle. |
| Recommendation — Classify prompt injection evidence under A3 and preserve the exact prompt for investigation. | ||
| MITRE ATT&CK | T1059 — Command and Scripting Interpreter | Supports technique-level thinking when AI abuse leads to executable actions. |
| Recommendation — Use technique mapping to trace AI abuse into action paths that defenders can hunt and block. | ||
| NIST AI RMF | MAP — Map | Helps structure AI risk understanding before selecting controls. |
| Recommendation — Use MAP to inventory AI misuse patterns and align them with the right safeguards. | ||
