How does the Pyramid of Pain work?

How the Pyramid of Pain Changes Detection Strategy

The pyramid of pain is a prioritisation model, not just a list of indicators. It helps defenders decide which kinds of detection create the most work for an adversary, so you are not spending effort on signals that are easy to swap out. In practice, the model pushes teams away from overreliance on one-off indicators and toward detections that reveal repeatable tradecraft.

The basic idea is that not all indicators hurt attackers equally. A hash, domain, or IP address can be replaced quickly, so detections built only on those signals are easy to evade. Higher on the pyramid, tactics, tools, infrastructure patterns, and behavioural choices are harder to change because they reflect how an operation is run. That is why the model is useful for choosing where to invest detection engineering time.

This is also why the model is often discussed alongside Threat Intelligence Guide, which covers the intelligence lifecycle and the relationship between indicators, behaviour, and action. The pyramid is most effective when it is used to translate intelligence into detections that force adaptation rather than simple indicator replacement.

Why Some Indicators Are Easy to Replace and Others Are Not

The lower levels of the pyramid usually capture tactical, machine-readable observables. Those are valuable for rapid blocking or hunting, but they are often short-lived because attackers can rotate infrastructure, rebuild malware, or change a sample with little operational cost. That makes these indicators useful for speed, but weak for sustained pressure.

As you move up the pyramid, the defender is no longer asking “What exact artifact did we see?” but “How did the adversary operate?” Behavioural detections are harder to evade because they describe a method, sequence, or workflow rather than a single object. If a rule is based on a tactic or repeated behaviour, the attacker has to change the operation itself, not just regenerate a file or move to a new address.

The strongest value comes from detections that survive minor changes in tooling or infrastructure. A good rule does not depend on a single sample or host artefact unless that artefact is part of a larger pattern that remains stable across campaigns. That makes the pyramid especially useful for deciding whether a detection belongs in a fast triage queue or in a longer-lived threat-hunting and monitoring programme.

What Good Pyramid of Pain Detections Look Like in Practice

A practical Pyramid of Pain programme mixes layers rather than choosing only the top. Low-level indicators still have operational value for containment and retrospective search, but they should not be the only thing you track. The mature pattern is to use those fast indicators to seed investigation, then move upward to the behaviours, tooling patterns, and procedures that better expose repeated adversary activity.

This is where the model aligns naturally with MITRE ATT&CK Enterprise Matrix, because ATT&CK gives defenders a structured way to describe tactics and techniques instead of only recording indicators. When teams map detections to techniques, they usually get better reuse, clearer hunting hypotheses, and less dependency on fragile signatures.

It also helps to pair the pyramid with operational controls that make behavioural detection more trustworthy. Logging, alert enrichment, and correlation matter because a higher-level indicator is only useful if it can be observed consistently and explained clearly enough to support response. Without that, a “stronger” indicator may be harder to action than a simpler one.

Risk and Threat Considerations

Overfocusing on easy indicators creates a false sense of coverage. Attackers expect defenders to chase hashes, domains, and IPs first, so they can rotate those artifacts cheaply while keeping the underlying playbook intact. The real risk is not that low-level indicators are useless, but that teams mistake them for durable detection and miss the adversary’s repeatable method.

Failure mechanism: Detection logic is anchored to easily changed objects instead of stable tactics or behavioural sequences, so the attacker alters tooling or infrastructure and the control stops firing.

Impact: The same campaign can reappear under new indicators with little friction, extending dwell time, weakening hunting coverage, and forcing repeated cleanup rather than lasting disruption.

Practitioner Guidance

What to prioritise: Build detections that answer “what behaviour is this?” before “what exact artifact is this?” If an alert only triggers on a hash, IP, or domain, treat it as a starting point, not a complete control.

What to verify: Check whether each detection can survive routine adversary changes such as recompiled malware, rotated infrastructure, or a replaced service. If a small attacker change breaks the rule, move the logic higher on the pyramid.

Practitioner takeaway: The Pyramid of Pain is most useful when it shifts your detection design from artifact chasing to behaviour forcing, because durable detections are the ones that make an attacker spend time changing tradecraft, not just replacing objects.

Related resources from NHI Mgmt Group

• Pyramid of Pain
• AI Security Pyramid Of Pain
• What is an SVID and how does it work?
• How does OAuth 2.0 work for NHIs and what are its limitations?