What Is Techniques? Definition & Examples

Techniques are the specific methods, procedures, or attack patterns used to achieve a security objective. In cybersecurity frameworks, they describe how an adversary, operator, or system carries out a tactic, such as credential theft, lateral movement, or persistence, and they help analysts map behavior to controls, detection logic, and response actions.

How techniques are used in cybersecurity

Techniques describe the concrete “how” behind a tactic, so they are the level at which defenders and attackers can actually observe behavior. A single tactic such as persistence may be carried out through many techniques, each with different indicators, preconditions, and controls.

This matters because security teams do not defend against intent alone, they defend against implementation details. Understanding the technique level helps separate a broad objective from the actual actions, such as phishing for initial access, token theft for credential access, or remote service execution for lateral movement.

Why techniques matter for detection and mapping

Techniques are useful because they connect observed activity to a repeatable analytic model. Detection engineering, incident triage, and threat hunting all become more precise when analysts can name the specific technique instead of only describing the outcome.

That mapping also helps teams compare unrelated alerts and campaigns. Two attacks may share the same tactic but use different techniques, which means they may require different telemetry, different rules, and different containment steps.

Techniques in adversary and defender workflows

In offensive and defensive work, techniques are the practical building blocks of a campaign or control set. Adversaries chain techniques to progress from access to impact, while defenders group controls, detections, and response logic around the same technique families.

In practice, this is why frameworks such as the MITRE ATT&CK Enterprise Matrix remain widely used for enterprise threat analysis, and why the MITRE D3FEND knowledge graph is helpful for pairing techniques with defensive countermeasures.

When the subject shifts to AI systems and autonomous workflows, the same idea still applies, but the technique set changes. The MITRE ATLAS adversarial AI threat matrix is designed to describe AI-specific techniques such as prompt injection, memory manipulation, context poisoning, and tool misuse.

What techniques reveal about security posture

Techniques expose the operational reality of an environment: which paths are available, which controls are weak, and which telemetry is missing. A mature security program studies techniques not just to understand attacks, but to identify the gaps that allow those attacks to succeed repeatedly.

For that reason, techniques are also a bridge between strategy and execution. They turn broad threat discussions into concrete questions about authentication, privilege, segmentation, logging, and response, which is why they are central to threat-informed defense.

Risk and Threat Considerations

Techniques matter because attackers rarely rely on a single method. They combine multiple techniques to evade detection, persist after initial access, and move laterally until they reach a valuable target or a disruptive outcome.

Failure mechanism: If defenders model only the tactic or the final impact, they can miss the specific technique that makes the attack possible, such as credential theft, abuse of trusted tooling, or stealthy execution through legitimate services.

Impact: That gap can lead to missed detections, delayed containment, and repeated compromise across environments that look different on the surface but share the same attack pattern underneath.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

MITRE ATT&CK and OWASP Agentic AI Top 10 define the specific risk controls and attack patterns relevant to this term.

Framework	Control / Reference	Relevance
MITRE ATT&CK	Tactic and Technique model — Tactics and Techniques	Directly defines attacker techniques as the concrete methods behind adversary behavior.
	Credential Access — Credential Access	Techniques frequently describe how attackers steal or abuse credentials during enterprise intrusions.
Recommendation — Map observed behavior to ATT&CK techniques and tune detections to the specific methods used. Track credential-related activity to the relevant ATT&CK technique and prioritize identity-focused detections.
OWASP Agentic AI Top 10	ASI02 — Tool Misuse	Agentic systems can be abused through technique-like behaviors that misuse tools at runtime.
Recommendation — Model tool abuse as a technique class and add controls around tool invocation and approval.

Techniques