Attack, Defend, Recover is a simple cyber resilience framework that groups security work into three phases. It describes the attacker’s action, the protective controls that reduce risk, and the recovery measures used to restore services after compromise or disruption.
How the framework works
Attack, Defend, Recover is a resilience model, not a product or a single control. It is useful because it separates hostile activity, defensive hardening, and restoration work into phases that teams can assign, measure, and improve without collapsing them into one vague security programme.
The framework is also a reminder that resilience is temporal. An organisation may be well defended before an incident, but it still has to absorb attack, limit blast radius, and restore service under pressure. That makes the model practical for planning, incident response, and executive communication.
Attack: understanding the pressure on the environment
The attack phase describes how a threat acts against the environment, whether through exploitation, credential abuse, phishing, lateral movement, or disruption. Thinking in this phase helps teams identify where controls can fail under real adversary behaviour rather than idealised assumptions.
For modern attacks, the path into a system is often the same path the attacker later uses to expand access. That is why defenders need to study the attack phase as a sequence, not a single event, and why resources such as MITRE ATT&CK Enterprise Matrix remain useful for mapping techniques to observables.
Defend: reducing exposure before compromise
The defend phase covers the protective measures that make compromise harder, slower, or less useful. In practice, this includes hardening, access limitation, detection, segmentation, secure configuration, and reducing unnecessary trust between systems.
Defence is most effective when it is layered. A single preventive measure rarely holds against sustained pressure, so resilience depends on controls that constrain attack paths, limit standing access, and increase the chance of early detection. NIST Cybersecurity Framework 2.0 is useful here because it frames protection as part of a broader govern, identify, protect, detect, respond, and recover cycle.
Recover: restoring service and trust after disruption
The recover phase is about getting the organisation back to a known-good state after an incident or outage. That includes restoring systems, validating integrity, rebuilding confidence in data and access paths, and deciding what must be reissued or reconfigured before normal operations resume.
Recovery is not just backup restoration. If compromise touched credentials, tokens, keys, or privileged access paths, recovery also requires revocation, rotation, and assurance that the attacker did not leave persistence behind. Guidance on recovery-oriented planning in NIST Cybersecurity Framework 2.0 helps anchor that broader restoration mindset.
Risk and Threat Considerations
The main risk in this model is false completeness, treating the existence of controls or backups as proof that the organisation can survive a real attack. If defend and recover are not tested against realistic adversary behaviour, a weak assumption can fail at the worst possible moment.
Failure mechanism: attackers exploit the gap between preventive control design and actual operational resilience, then use that gap to persist, expand access, or delay restoration.
Impact: the organisation may lose service continuity, confidence in data integrity, or control over identity and access paths during recovery.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | TA0001 — Initial Access | The attack phase is built around adversary access paths and techniques. |
| Recommendation — Map expected intrusion paths to ATT&CK and hunt for the corresponding techniques. | ||
| NIST CSF 2.0 | RC.RP-01 — Recovery Plan is Executed | The framework's recover function directly matches restoring services after compromise. |
| PR.AA-05 — Least Privilege | Defend work in this model depends on limiting access so attacks have less leverage. | |
| Recommendation — Validate recovery plans by exercising restoration under realistic incident conditions. Apply least-privilege controls to reduce the blast radius of a compromise. | ||
Practitioner Guidance
Why practitioners should care: this framework is most valuable when it is used to organise ownership. Security leaders, operations teams, and incident responders should each know which phase they are responsible for and how success is measured in that phase.
Common misunderstanding: teams often over-invest in defend and under-invest in recover, even though the real test of resilience is whether the organisation can restore trustworthy operations after controls have been bypassed.
Practitioner takeaway: use the model to pressure-test whether your defensive assumptions, response runbooks, and recovery dependencies still work when an attacker is already inside the environment.
Related resources from NHI Mgmt Group
- How should organisations defend against attack-as-a-service identity fraud?
- How should security teams defend against LLM-powered malware that adapts during an attack?
- How should security teams defend against AI-assisted attack chains in production environments?
- How should security teams defend against spoofing and phishing as a combined attack chain in enterprise environments?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 29, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org