Adversary Tactics

What adversary tactics mean in practice

Adversary tactics describe the attacker’s high-level goals during an intrusion, such as initial access, persistence, lateral movement, privilege escalation, command and control, and exfiltration. They help defenders think about the campaign stage first, then map specific techniques and telemetry to the behaviour they need to stop, detect, and investigate.

That makes tactics more useful than a one-off indicator. A single malicious file or IP can disappear, but a tactic remains stable across tools, payloads, and environments, which is why defenders use tactic-based mapping to organise threat hunting, detection engineering, and incident response.

How tactics relate to techniques and procedures

Tactics sit above techniques. The tactic is the attacker objective, while the technique is the method used to achieve it, such as password spraying, remote service abuse, or token theft. Procedures sit one layer lower still, describing the concrete steps an actor uses in a particular campaign.

This hierarchy matters because defenders rarely see the full attack chain at once. If a security team can recognise the tactic being pursued, it can group otherwise unrelated events into a coherent intrusion path and avoid treating each alert as an isolated problem.

Frameworks such as MITRE ATT&CK Enterprise Matrix and MITRE ATLAS adversarial AI threat matrix are useful because they organise tactics into a common language for detection, red teaming, and threat modelling across traditional enterprise systems and AI-enabled environments.

Why tactic mapping strengthens detection and investigation

Tactic mapping improves operational visibility because it links signals from endpoint, identity, network, and cloud layers to a single intrusion objective. For example, repeated authentication failures, unusual session creation, and internal discovery can mean different things in isolation, but together they may indicate the adversary is moving toward persistence or lateral movement.

It also helps investigators prioritise what to look for next. When a team knows which tactic is in play, it can test whether the attacker has already reached adjacent stages, whether defenders missed a transition point, and whether the same behaviour has appeared elsewhere in the environment.

That is why many threat references, including the CISA cyber threat advisories, describe intrusions in terms of observed adversary behaviour rather than only the malware name or exploited flaw.

Where adversary tactics fit in defence strategy

Tactics are most valuable when they are used to connect strategy to control design. They tell defenders which behaviours should be denied, logged, alerted on, or contained, and they provide a stable way to compare campaigns over time even when the attacker changes tooling.

In mature programmes, tactic coverage becomes a planning tool for detection engineering, purple teaming, and post-incident review. It helps teams ask not just what happened, but what stage of the intrusion the organisation actually interrupted, and where the attacker still had room to continue.

For deeper reading on real-world attack patterns and the kinds of intrusion behaviours defenders map to tactics, see The State of NHI & AI Agent Breach Report 2026.

Related resources from NHI Mgmt Group

• Why do documented adversary tactics matter more than the country label when assessing cyber risk?
• Adversary Tactics, Techniques, and Common Knowledge
• Adversary Tactics, Techniques, and Procedures (TTPs)
• How should security teams stop adversary-in-the-middle attacks on MFA-protected accounts?