MITRE ATT&CK and the identity security gap it exposes

At a glance

What this is: MITRE ATT&CK is an open adversary-behaviour knowledge base that helps security teams map tactics, techniques, and procedures across the attack lifecycle.

Why it matters: It matters because IAM, NHI, and security engineering teams need a common way to connect identity controls, detections, and response actions to how attackers actually operate.

👉 Read 1Kosmos' overview of MITRE ATT&CK and adversary behaviour

Context

MITRE ATT&CK is a structured way to describe how adversaries operate, from initial access through persistence and impact. For identity teams, the point is not the taxonomy itself, but the discipline of mapping controls and detections to observable attacker behaviour instead of relying on vague risk statements.

That matters across human IAM and NHI governance because real attacks often move through identity footholds, credential abuse, privilege escalation, and lateral movement before detection. A framework that normalises attacker behaviour helps teams decide where their identity controls are thin, where telemetry is incomplete, and where response playbooks need to be more specific.

Key questions

Q: How should security teams use MITRE ATT&CK in identity programmes?

A: Use ATT&CK to connect identity events to attacker behaviour, not just to label alerts. Map authentication, privilege, token, and session activity to specific techniques so SOC, IAM, and cloud teams can see escalation, persistence, and lateral movement in the same model. That makes controls easier to validate and response actions easier to prioritise.

Q: Why does MITRE ATT&CK matter for NHI governance?

A: Because non-human identities often provide the access path an attacker needs after initial compromise. ATT&CK helps teams understand how credential abuse, over-privilege, and lateral movement turn an NHI foothold into broader impact. It is useful for identifying where governance, telemetry, or response failed to interrupt the chain.

Q: What do security teams get wrong about ATT&CK?

A: They often treat it as a reporting taxonomy instead of a control-validation model. ATT&CK is most valuable when it helps teams prove whether a control can detect or block a specific technique, and whether the response process can act before the attacker reaches impact.

Q: How can ATT&CK help teams evaluate identity detection coverage?

A: Use it to test coverage at the technique level across authentication, escalation, persistence, and movement. If a control only detects generic account misuse, it will miss the more specific behaviour that shows how an attacker advanced. Technique-level mapping creates a clearer view of real detection gaps.

Technical breakdown

ATT&CK tactics, techniques, and sub-techniques

ATT&CK organises adversary behaviour into tactics, techniques, and sub-techniques. A tactic is the attacker’s goal, such as persistence or privilege escalation. A technique is the method used to reach that goal, and a sub-technique adds implementation detail, such as one form of UAC bypass inside a broader escalation pattern. The value for defenders is that the model separates intent from method, which makes detection engineering and threat hunting more precise. Teams can map telemetry to technique-level behaviour instead of writing generic alerts that miss context.

Practical implication: Use ATT&CK to map detections and response steps to specific attacker behaviours, not broad threat labels.

Why ATT&CK improves identity detection and response

Identity activity is often the connective tissue in modern intrusions, especially where credentials, tokens, or session abuse create access that looks legitimate at first glance. ATT&CK gives analysts a common structure for linking identity events to escalation, persistence, and movement across environments. That is useful in incident response because it helps teams understand not just what happened, but how the attacker advanced and which control layers failed to interrupt them. In practice, it sharpens triage, containment sequencing, and post-incident root-cause analysis.

Practical implication: Correlate identity telemetry to ATT&CK stages so responders can see where the attacker progressed and where controls failed.

Using ATT&CK for security testing and product design

ATT&CK is also a design tool. Red teams, validation teams, and product engineers use it to build realistic attack scenarios and check whether controls detect or block them. That matters because many identity programmes overestimate coverage when they test only policy compliance, not attacker behaviour. ATT&CK forces a different question: can the programme see the technique, attribute it correctly, and contain it before impact? For identity architectures, that means testing privilege escalation, token abuse, and lateral movement paths as actual behaviours rather than abstract risks.

Practical implication: Build tests around attacker techniques so identity controls are evaluated against real failure paths, not policy checklists.

Threat narrative

Attacker objective: The attacker’s objective is to convert identity access into durable operational advantage, then use that access to steal, disrupt, or control targeted systems.

1. Entry typically begins when an attacker gains a foothold through compromised credentials, phishing, or another initial access path that places identity at the center of the incident.
2. Escalation follows when the attacker uses those credentials or adjacent permissions to expand reach, persist, or move laterally in ways that resemble legitimate activity.
3. Impact occurs when the attacker completes data theft, ransomware deployment, or other objective using the authority already attached to the compromised identity.

Breaches seen in the wild

• Cisco DevHub NHI breach — IntelBroker exploited exposed Cisco credentials, API tokens and keys in DevHub.
• Salt Typhoon US telecoms breach — Salt Typhoon APT used stolen credentials and Cisco CVE to breach US telecoms.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

MITRE ATT&CK is most useful to identity teams when it turns adversary behaviour into governance evidence. ATT&CK is not just a detection catalog. It gives IAM and NHI programmes a common structure for proving where attackers abuse identity, where telemetry is missing, and which controls actually interrupt the chain. That makes it valuable as an operating model for cross-functional work between identity, SOC, and cloud security teams. Practitioners should use it to align control design with observable attacker behaviour.

Identity programmes still fail when they treat ATT&CK as a security operations artifact rather than a governance bridge. The framework becomes useful only when it is tied to ownership, response playbooks, and control validation. If identity events are not mapped to escalation, persistence, and lateral movement, teams end up with noisy detections and weak accountability. The implication is that ATT&CK should sit inside the identity governance conversation, not outside it.

Identity blast radius is the right concept for ATT&CK-driven NHI work. Once credentials, tokens, or sessions are compromised, the real question is how far the attacker can move before controls interrupt them. ATT&CK helps teams measure that blast radius across human accounts, service accounts, and workload identity. The practitioner takeaway is to assess how much authority each identity type can expose under real attack conditions.

ATT&CK improves resilience only when it is paired with control validation, not framework adoption. The framework is descriptive, not prescriptive. That means the security value comes from testing whether your controls detect specific techniques and whether your response process can act on them quickly enough. For identity security leaders, the practical conclusion is simple: measure coverage by technique, not by policy count.

For autonomous and AI-adjacent identity work, ATT&CK is still useful but must be interpreted through runtime behaviour. Where an AI system can select tools or actions at runtime, the defender needs to understand how technique chains emerge from that behaviour rather than from a fixed workflow. That does not replace identity governance. It raises the bar for how identity telemetry, authorization boundaries, and response timing are assessed. Practitioners should extend ATT&CK-style mapping into agent behaviour where autonomy is real.

From our research:

• 85% of organisations lack full visibility into third-party vendors connected via OAuth apps, with 38% reporting no or low visibility and a further 47% only partial visibility, according to The State of Non-Human Identity Security.
• That visibility gap matters because only 1.5 out of 10 organisations are highly confident in their ability to secure NHIs, according to The State of Non-Human Identity Security.
• For a deeper control lens, pair that finding with Ultimate Guide to NHIs , Key Challenges and Risks and use it to prioritise visibility before entitlement expansion.

What this signals

Identity teams should expect ATT&CK-style mapping to become more important as NHI sprawl and delegated access expand. The practical shift is from control inventories to behaviour inventories. When third-party and workload identities are already hard to see, the first governance task is to expose where attacker techniques would land if one of those identities were abused.

Identity blast radius is the operational metric that should sit beside detection coverage. If a service account, token, or OAuth grant can move farther than the programme can observe, ATT&CK becomes the language for proving that gap. Pair this with the Ultimate Guide to NHIs when setting baselines for scope, rotation, and offboarding.

Attack-technique mapping will increasingly need to cover autonomous behaviour where runtime decisions change the chain of abuse. Where agents can choose tools or actions dynamically, defenders need to understand how those choices alter telemetry, containment, and accountability. For that reason, security architects should start extending technique mapping into agentic workflows before they become routine.

For practitioners

• Map identity detections to ATT&CK techniques Tag authentication, token, and privilege events to technique-level behaviour so analysts can see escalation and lateral movement patterns instead of isolated alerts.
• Use ATT&CK in incident playbooks Rewrite response runbooks so containment steps are aligned to the attacker stage, especially when compromised credentials or session abuse is the entry point.
• Validate controls against attacker behaviour Run red-team or simulation tests that try to reproduce specific techniques, including token misuse, privilege escalation, and persistence through identity footholds.
• Measure identity blast radius by actor type Compare how far a human account, service account, or workload identity can move under abuse, then tighten the authority that produces the largest blast radius.
• Extend ATT&CK mapping to AI agent behaviour Where autonomous or agentic systems are present, map runtime tool use and delegated actions to attack techniques so the programme can see scope drift before impact.

Key takeaways

• MITRE ATT&CK matters to identity security because it translates adversary behaviour into a shared control and detection model.
• The framework is most useful when teams map identity events to escalation, persistence, and movement instead of treating alerts as isolated signals.
• Security programmes should validate controls against specific techniques, because framework adoption alone does not reduce attacker reach.

Key terms

• Adversary Tactics, Techniques, and Common Knowledge: A structured way to describe how attackers operate, using goals, methods, and implementation details. In practice, it helps defenders separate what the attacker wanted from how they achieved it, which improves detection engineering, incident analysis, and control validation.
• Technique-level detection: Detection that targets a specific attacker method rather than a broad category of suspicious activity. This approach is stronger for identity security because it can distinguish escalation, persistence, and credential abuse from ordinary administrative behaviour.
• Identity blast radius: The amount of access, movement, and downstream authority an attacker can gain after compromising an identity. It is not just about the credential itself, but about how far the abuse can spread before the organisation detects and contains it.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.

This post draws on content published by 1Kosmos: MITRE ATT&CK explained and its role in cybersecurity defence. Read the original.