Attack Taxonomy

A structured vocabulary for describing attacker behaviour in a consistent way. In practice, taxonomies like ATT&CK help teams map detections, incidents, and controls to shared technique names so reporting and analysis can be compared across tools and time.

Expanded Definition

An attack taxonomy is a controlled vocabulary for describing attacker behaviour so defenders can compare incidents, detections, and mitigations using the same labels. In NHI and agentic AI environments, that shared language matters because the same event can appear as secret theft, token abuse, prompt injection, or lateral movement depending on the system involved. A taxonomy does not replace incident detail; it organises it. It helps analysts map evidence to repeatable technique names, then correlate those techniques across logging, detection engineering, and post-incident review. This is why frameworks such as the MITRE ATLAS adversarial AI threat matrix are useful alongside broader references like CISA cyber threat advisories. Definitions vary across vendors when they blend taxonomy with kill-chain stages or product-specific alert categories, so practitioners should treat any taxonomy as an indexing system, not a complete theory of attack intent. The most common misapplication is using taxonomy labels as proof of root cause, which occurs when teams map an alert to a technique before validating the underlying evidence.

Examples and Use Cases

Implementing an attack taxonomy rigorously often introduces classification overhead, requiring organisations to balance faster reporting against the cost of analyst training and consistent labeling. In practice, the value is highest when the taxonomy is used to connect raw telemetry to repeatable defense decisions. That is why NHIMG research on Ultimate Guide to NHIs and related analysis in the 52 NHI Breaches Analysis is useful for translating abstract technique names into concrete NHI failure modes.

• Mapping repeated API key theft into a single technique label so SOC analysts can see whether access is coming from phishing, code exposure, or vault misconfiguration.
• Tagging service-account abuse in cloud logs with consistent technique names so incident timelines can be compared across teams and environments.
• Using a taxonomy to normalise AI-agent tool misuse, where the same attack may look like stolen secrets in one system and unauthorised action execution in another.
• Comparing control coverage after an incident by asking which techniques were detected, contained, or missed rather than only counting alerts.
• Aligning detections to MITRE ATLAS so AI-specific attacker patterns can be tracked alongside conventional infrastructure abuse.

Attack taxonomy also improves executive reporting because it converts incident noise into trends that can be tracked over time, especially when teams must show whether a threat is new, repeated, or merely renamed by a tool vendor.

Why It Matters in NHI Security

For NHI security, attack taxonomy matters because service accounts, API keys, OAuth tokens, and AI-agent credentials fail in different ways but are often compromised through the same attacker behaviours. Without a common taxonomy, organisations miss pattern continuity between secret exposure, privilege escalation, and persistence. NHIMG’s Ultimate Guide to NHIs — Why NHI Security Matters Now reports that 80% of identity breaches involved compromised non-human identities such as service accounts and API keys, which shows how often attackers reuse familiar techniques against machine identities. A taxonomy helps defenders connect that abuse to governance decisions such as rotation, scope reduction, and detection engineering. It also supports control mapping against frameworks like CISA cyber threat advisories and AI-specific guidance such as the Anthropic AI-orchestrated cyber espionage campaign report, especially when attacker behavior spans both infrastructure and model-driven workflows. Organisations typically encounter the need for a clear attack taxonomy only after a breach review reveals that multiple teams described the same compromise in incompatible terms, at which point remediation prioritisation becomes operationally unavoidable to address.

Related resources from NHI Mgmt Group

• Attack Surface Management
• Why does Agentic AI make NHI attack surface expand so significantly?
• What is the difference between attack surface management and NHI governance?
• Why do NHIs create a larger attack surface than human users?