Notifications
Clear all
Topic starter
02/08/2026 12:21 pm
TL;DR: MITRE is planning to deprecate Defense Evasion in ATT&CK v19 and replace it with Stealth and Impair Defenses, a change that will force SOC teams to remap detections, reporting, and playbooks across tooling and workflows, according to D3. The shift matters because it exposes how much operational security logic is still coupled to a taxonomy that is about to change.
NHIMG editorial — based on content published by D3: MITRE is planning major ATT&CK changes in 2026
Questions worth separating out
Q: What should SOC teams do when ATT&CK tactic mappings change?
A: SOC teams should treat tactic changes as a controlled migration, not a naming update.
Q: Why does a split between Stealth and Impair Defenses matter to defenders?
A: It matters because concealment and control disruption are different operational problems.
Q: What breaks when ATT&CK tactic labels are hard-coded into SOC workflows?
A: Hard-coded tactic labels break as soon as a framework version changes.
Practitioner guidance
- Update ATT&CK mappings before v19 lands Inventory every detection rule, dashboard, report, and vendor integration that references Defense Evasion.
- Separate concealment from control disruption Split analytics into two operational buckets.
- Create a versioned framework change log Track ATT&CK version, tactic ID, technique name, and downstream dependencies in a single register.
What's in the full article
D3's full article covers the operational detail this post intentionally leaves for the source:
- MITRE’s proposed tactic re-categorisation notes and the specific technique changes discussed at ATT&CKCon.
- The ATT&CK v18 detections architecture overhaul and why it may break products that parse framework content.
- The public Navigator layer used to visualise the proposed changes and support community discussion.
- The discussion notes from Cat Self and Adam Pennington on how the transition is expected to play out.
👉 Read D3’s analysis of MITRE ATT&CK’s 2026 tactic split and SOC impact →
ATT&CK’s defense evasion split: what will SOC teams need to change?
Explore further
02/08/2026 1:22 pm
Framework taxonomies are now operational dependencies, not reference material. When ATT&CK changes a core tactic, the impact reaches detection engineering, reporting logic, and vendor integrations. That means SOC leaders need to manage ATT&CK versions the way they manage any other production dependency. Framework governance is therefore part of security operations maturity, not a side function.
A question worth separating out:
Q: Who is accountable when framework changes disrupt detection coverage?
A: Accountability sits with the security function that owns detection engineering, content governance, and reporting quality. Vendors can supply updates, but the organisation is responsible for validating downstream impact and maintaining continuity. Framework changes should be managed through change control, with clear ownership for mapping updates, regression testing, and stakeholder communication.
👉 Read our full editorial: MITRE ATT&CK’s 2026 tactic split will reshape SOC mapping
