MITRE ATT&CK and the identity security gap it exposes

At a glance

What this is: This is an analysis of MITRE ATT&CK as a threat-behaviour framework and the identity governance gap it leaves open when teams stop at mapping alone.

Why it matters: It matters because IAM, PAM, and NHI teams need ATT&CK-style adversary mapping to inform controls, but still must translate that insight into lifecycle, access, and detection decisions.

Context

MITRE ATT&CK is a knowledge base for adversary behaviour, not a control standard. It helps security teams describe how attackers move through initial access, privilege escalation, persistence, and impact, which makes it useful for detection engineering and incident response.

For identity programmes, the gap is that ATT&CK explains attacker behaviour better than it explains governance decisions. IAM, PAM, and NHI teams still have to decide how those tactics map to access scope, credential lifecycle, and monitoring boundaries in their own environment.

Key questions

Q: How should security teams use MITRE ATT&CK in identity programmes?

A: Security teams should use ATT&CK to describe how adversaries move through identity environments, then convert those techniques into specific control decisions. The framework is most useful when it informs detection logic, privilege design, and incident triage rather than serving as a standalone governance model. Identity programmes still need their own ownership, review, and lifecycle controls.

Q: Why does PQC planning matter to IAM and PAM teams?

A: Because authentication, privileged access, and workload trust all depend on cryptographic primitives that may need post-quantum replacement. IAM and PAM teams own many of the systems that will break first if trust assumptions are not mapped early. PQC is therefore an identity architecture issue, not only a cryptography issue.

Q: What breaks when organisations only map threats to ATT&CK and stop there?

A: What breaks is the translation from threat awareness to governance action. Teams may know the attacker’s tactic but still lack clear ownership for access changes, lifecycle review, or privilege reduction. The result is better reporting without a corresponding change in who can do what, for how long, and under which conditions.

Q: What is the difference between ATT&CK mapping and identity governance?

A: ATT&CK mapping describes adversary behaviour in a common language. Identity governance decides how access, privilege, ownership, and review are controlled in the environment. The two work together, but they are not interchangeable, because a technique label does not tell you who owns the control or how the access model should change.

Technical breakdown

How ATT&CK structures adversary behaviour

MITRE ATT&CK organises attacker activity into tactics, techniques, and sub-techniques. That structure matters because it gives teams a repeatable way to describe what an adversary is trying to achieve, rather than relying on vague alert labels. In practice, the matrix links behaviour to data sources and mitigations, which helps analysts connect detection logic to known attack paths. Its value is strongest when teams want to standardise threat language across SOC, detection engineering, and incident response. Practical implication: use the matrix to normalise how your team names and tracks adversary actions.

Practical implication: Map detections and incident notes to ATT&CK tactics so analysts and engineers speak the same language.

Why privilege escalation and credential access matter to identity teams

ATT&CK is especially relevant where identity is the path to higher access. Privilege escalation, credential access, and lateral movement show how attackers turn one foothold into broader control, which is why identity teams should care even when the initial compromise is not an IAM event. The framework does not replace identity governance, but it does reveal where access design fails under attack pressure. That makes it useful for spotting where standing privilege, weak authentication, or poor segmentation widen blast radius. Practical implication: treat ATT&CK as an adversary lens for testing identity controls.

Practical implication: Use ATT&CK to test whether privilege pathways, credential protections, and access boundaries hold under attack.

Why ATT&CK needs to be translated into governance decisions

ATT&CK tells you what attackers do, but not how your programme should govern access, ownership, or review cadence. That translation layer is where identity security becomes operational, because the same technique can have different meaning in human IAM, NHI governance, or autonomous systems. For example, a technique that exposes credential misuse may require account lifecycle changes in one environment and runtime access constraints in another. The framework is useful precisely because it stays descriptive rather than prescriptive. Practical implication: turn ATT&CK findings into control decisions, not just better reporting.

Practical implication: Convert ATT&CK mapping into concrete IAM, PAM, and NHI control changes instead of stopping at classification.

Threat narrative

Attacker objective: The attacker aims to convert a single foothold into durable access that supports broader control, collection, and impact.

1. Entry typically begins with an initial access technique that gives the adversary a foothold in the environment.
2. The attacker then moves toward credential access or privilege escalation to expand control and reach more sensitive systems.
3. From there, lateral movement and persistence allow the adversary to operate beyond the first compromised account.
4. The end state is impact, where the adversary can steal data, disrupt systems, or undermine trust in identity controls.

Breaches seen in the wild

• Nx s1ngularity attack 2025: Attackers stole Nx's npm token via a GitHub Actions flaw and shipped malware that stole 2,349 secrets and abused developers' AI CLIs.
• PyPI secrets exposure 2023: Researchers found 3,938 unique secrets in published PyPI packages, 768 still valid; a new release or yank does not remove them.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

ATT&CK is a behaviour model, not an identity governance model: That distinction matters because the framework explains how adversaries operate, but it does not decide who should have access, for how long, or under what lifecycle conditions. Identity teams should use ATT&CK to sharpen threat understanding, then translate that into IAM, PAM, and NHI controls. The practitioner conclusion is that mapping is necessary, but governance is still a separate discipline.

Credential access and privilege escalation are the points where identity becomes the attack path: ATT&CK is most valuable to identity teams when it exposes how access itself becomes an adversary resource. Once a foothold exists, the attacker’s next moves often depend on credential exposure, privilege gain, and reuse of legitimate access paths. The implication is that identity security must be designed around attacker behaviour, not just around onboarding and authentication events.

Shared language is the framework’s real operational value: ATT&CK helps analysts, responders, architects, and product teams describe the same threat in consistent terms. That consistency improves detection engineering, incident triage, and control testing, especially when identity signals are distributed across cloud, endpoint, and directory systems. The practitioner conclusion is that ATT&CK should be the common vocabulary for attack understanding, while identity governance defines the control response.

ATT&CK exposes an identity security gap that many programmes still leave implicit: adversary behaviour is often mapped to detections, but not to ownership, lifecycle, or privilege boundaries. That gap leaves teams with threat visibility but uneven remediation authority. The practical lesson is to make identity control ownership part of the same operating model that ATT&CK helps standardise.

Identity blast radius is the useful concept here: ATT&CK shows how a compromise progresses, but identity teams should ask how far that progress can travel once credentials, roles, or tokens are abused. The matrix becomes most useful when it is tied to access scope and trust boundaries. The practitioner conclusion is to measure attack behaviour against the size of the identity blast radius your controls allow.

What this signals

ATT&CK is most useful when it becomes an operating vocabulary for identity teams: the value is not the matrix itself, but the way it helps security, IAM, and SOC teams align on what adversary behaviour means in practice. Once that language is shared, teams can connect detection, response, and privilege decisions more consistently.

Identity programmes should treat ATT&CK as an input to governance design: if a technique can turn a foothold into higher privilege or lateral movement, the access model has to assume that behaviour will occur and limit its blast radius. That is especially important when the same control surface includes human accounts, service identities, and delegated access.

For practitioners

• Map adversary techniques to identity controls Align ATT&CK tactics such as credential access, privilege escalation, and lateral movement to the access controls and monitoring points that govern your human, NHI, and administrative identities.
• Use ATT&CK in detection engineering Build detection content around the techniques most likely to affect identity systems, then validate whether your telemetry can actually separate normal access from suspicious access paths.
• Translate threat mapping into lifecycle decisions Review whether accounts, tokens, and privileged roles are owned, scoped, and reviewed in ways that reflect the attack paths ATT&CK highlights, not just the way systems were provisioned.
• Test privilege boundaries against real attacker behaviour Use ATT&CK-based scenarios to check whether a compromised account can move from first access to sensitive systems without additional control failure.
• Align incident response playbooks to technique chains Make sure responders can move from a technique label to containment actions that are specific to the identity surface involved, including privileged accounts and delegated access.

Key takeaways

• MITRE ATT&CK helps security teams standardise how they describe adversary behaviour, but it does not replace identity governance.
• Its most practical value for IAM and PAM teams is in showing where credential access, privilege escalation, and lateral movement turn identity into the attack path.
• Teams get the most from ATT&CK when they translate technique mapping into access ownership, detection coverage, and privilege boundaries.

Key terms

• MITRE ATT&CK: MITRE ATT&CK is a public knowledge base that catalogues adversary tactics, techniques, and procedures. It helps security teams describe how attacks unfold in a consistent way so they can improve detection, response, and control testing across environments.
• Tactic: A tactic is the attacker’s immediate objective within the MITRE ATT&CK framework, such as gaining access, running code, or stealing credentials. Tactics sit above techniques in the model and help security teams understand what outcome the adversary is pursuing before considering the specific method used.
• Technique: A technique is the method an adversary uses to carry out a tactic. In ATT&CK, techniques turn abstract goals into concrete behaviours such as malicious script execution, token theft, or data exfiltration. They are useful because they map security findings to realistic attacker playbooks, not just control failures.
• Privilege Escalation: An attack technique where a compromised identity, often an NHI with initially limited permissions, exploits vulnerabilities or misconfigurations to gain elevated access rights, typically leading to broader compromise.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.