What is the difference between ATT&CK mapping and identity governance?

ATT&CK mapping and identity governance solve different problems

ATT&CK mapping is a threat-language exercise. It helps defenders describe how an adversary operates, which makes it useful for detection engineering, hunt planning, incident analysis, and gap assessment. Identity governance is a control-governance exercise. It decides who should have access, how privilege is granted, how ownership is assigned, and when reviews or removals should occur.

The distinction matters because a technique can describe abuse without telling you what the right control owner is, what policy should change, or which access path should be removed. Identity governance is about enforcing those decisions consistently across users, roles, entitlements, and lifecycle events.

How the two complement each other in practice

ATT&CK mapping is strongest when you want a common adversary model. It lets teams align detections, hunts, and incident notes to a shared technique set, so different analysts can talk about the same behavior without ambiguity. MITRE ATT&CK Enterprise Matrix is the canonical reference for that vocabulary, and it is most useful when the question is “what tactic or technique was used?” rather than “who owns this access decision?”

Identity governance is strongest when you need durable control over access and privilege. That includes joiner-mover-leaver handling, entitlement review, segregation of duties, role design, and ownership. NHIMG’s IAM and IGA Basics is the clearest starting point for understanding how authorization, access review, and governance differ from behavioral threat mapping.

Where they intersect, ATT&CK can reveal that a technique repeatedly succeeds because an access control is too broad, stale, or unowned. Identity governance then defines the remediation: tighten entitlement rules, remove dormant access, correct ownership, or redesign the role model. That is why teams often use ATT&CK to identify exposure patterns and IGA to fix the access structure behind them.

Why the difference matters for ownership, remediation, and auditability

ATT&CK mapping usually lands in security operations, threat hunting, detection engineering, or incident response. Identity governance usually lands in IAM, access governance, application owners, control owners, and audit teams. Those ownership boundaries are not cosmetic, because the action after discovery is different: one side asks how to detect or contain a technique, the other asks how to grant, certify, and revoke access correctly.

For lifecycle and entitlement work, the most useful governance view is often the one that tracks access from request to review to removal. NHIMG’s Access Reviews and Certification Guide helps because it turns review into an operational control rather than a checkbox. ATT&CK mapping does not replace that control, and it does not tell you whether a review is overdue, mis-scoped, or missing an owner.

For role structure, governance also matters more than technique labels. Role Mining and Role Design Guide shows the access-model side of the problem: if roles are bloated or poorly owned, no amount of ATT&CK coverage will fix the underlying entitlement design. ATT&CK may show repeated abuse, but identity governance is what determines whether the access model itself changes.

Risk and Threat Considerations

Confusing the two creates a control gap. If teams treat ATT&CK mapping as if it were governance, they may improve detection vocabulary without reducing excessive privilege, stale access, or orphaned accounts. If they treat governance as if it were threat mapping, they may tighten roles and reviews while still missing the attacker behaviors that matter most.

Failure mechanism: Technique labels describe behavior, not authority. When organizations mistake a mapped technique for a control decision, they can miss the ownership, entitlement, or lifecycle change needed to close the exposure.

Impact: The result is usually persistent privilege exposure, slower remediation, weaker audit evidence, and a false sense that a known attack path is “handled” because it has a name.

Practitioner Guidance

What to verify: Use ATT&CK to confirm the behavior you are seeing, then verify whether there is a corresponding access control, entitlement, or role decision that can actually reduce recurrence. If the issue is repeated abuse of legitimate access, governance remediation should be part of the answer.

Decision rule: If the question is “how do we detect or describe this activity?”, use ATT&CK mapping. If the question is “who owns this access, should it exist, and how is it reviewed or removed?”, use identity governance. When both are true, treat ATT&CK as the diagnostic layer and governance as the corrective layer.

Practitioner takeaway: ATT&CK mapping tells you how the environment is being abused; identity governance tells you whether the access model itself is defensible. Mature teams use both, but they never confuse a threat taxonomy with an access-control operating model.

Related resources from NHI Mgmt Group

• What is the difference between prompt injection risk and identity abuse in agents?
• What is the difference between clustering alerts and mapping them to the MITRE ATT&CK framework?
• What is the difference between ATT&CK coverage mapping and security control validation?
• What is the difference between technique level and sub-technique level mapping in ATT&CK testing?