The Pyramid of Pain is a prioritisation model that ranks indicators by how hard they are for an adversary to change. It pushes defenders toward higher-value detections such as techniques and behaviours, which tend to remain useful longer than hashes or IP addresses.
Expanded Definition
The Pyramid of Pain is a defender-focused prioritisation model used in threat detection and threat hunting. It groups indicators from easy-to-change artefacts, such as file hashes, IP addresses, and domain names, up to more durable signals like tools, behaviours, and techniques. The higher a detection maps on the pyramid, the more effort an adversary must spend to adapt. That is why the model is often used to guide detection engineering toward signals that create operational friction rather than temporary visibility.
In practice, the model is not a formal standard, and usage in the industry is still evolving. It is best treated as a strategic lens, not a strict taxonomy. Security teams often connect it to broader defensive planning in the NIST Cybersecurity Framework 2.0, especially where detection, response, and improvement activities need to be prioritised. The model also aligns naturally with adversary emulation and behaviour-driven analytics, because these approaches ask what the attacker must do next, not just what artifact appeared first.
The most common misapplication is treating the pyramid as a ranking of indicator importance rather than attacker cost, which occurs when teams chase high-volume indicators without considering how quickly the adversary can replace them.
Examples and Use Cases
Implementing the Pyramid of Pain rigorously often introduces a coverage-versus-effort tradeoff, requiring organisations to weigh quick wins from simple indicators against the longer-term value of behaviour-based detections.
- A SOC blocks a malicious IP range after a phishing campaign, then rapidly learns that the adversary rotates infrastructure and the block only helps briefly.
- A detection engineer builds alerts around a malware family’s command patterns and process tree, making it harder for the attacker to modify tooling without changing tradecraft.
- A threat hunt team maps observed activity to techniques in MITRE ATT&CK to identify repeatable behaviours across multiple incidents instead of one-off artifacts.
- An identity security team watches for suspicious use of service accounts and API tokens, because in NHI environments attackers often change infrastructure faster than they change their operational workflow.
- A blue team uses a CISA-informed incident response playbook to turn recurring detections into higher-value hunts that reveal technique-level reuse.
These examples show why the model is most useful when detections are layered: fast-moving indicators still have value, but they are treated as starting points rather than the end goal.
Why It Matters for Security Teams
The Pyramid of Pain matters because it shifts security teams away from fragile detections that disappear as soon as an adversary changes infrastructure. If analysts rely too heavily on hashes, domains, or IPs, they may create the illusion of control while missing the behaviours that actually define the intrusion. Technique-level detections support more durable monitoring, better hunt hypotheses, and stronger response decisions across the defensive lifecycle described in NIST Cybersecurity Framework 2.0.
This becomes especially relevant where identity and automation intersect. In NHI and agentic AI environments, adversaries may rotate secrets, clone tooling, or repurpose autonomous agents faster than defenders can blacklist single artifacts. Behavioural visibility is therefore more valuable than one-time indicators, particularly when service accounts, API keys, or agent tool calls are involved.
Organisations typically encounter the practical limits of low-level indicators only after repeat intrusions continue despite successful blocking, at which point the Pyramid of Pain becomes operationally unavoidable to address.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10, OWASP Agentic AI Top 10 and MITRE ATLAS address the attack and risk surface, while NIST CSF 2.0 and NIST AI RMF set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | DE.CM | The model supports continuous monitoring by emphasizing durable detection signals. |
| OWASP Non-Human Identity Top 10 | NHI environments benefit from behaviour-based detection when secrets and service accounts are rotated. | |
| OWASP Agentic AI Top 10 | Agentic systems can change artifacts quickly, making technique-level visibility more resilient. | |
| NIST AI RMF | MAP | AI risk mapping benefits from understanding adversary adaptation cost and durable signals. |
| MITRE ATLAS | ATLAS catalogs adversarial techniques that align with higher-value behavioural detections. |
Use technique mappings to move beyond brittle indicators and toward repeatable attack patterns.
