Develop Capabilities is the process of building or adapting tools, payloads, or operational tradecraft for an attack. It includes coding malware, modifying exploits, and preparing infrastructure or automation. Defenders should track new tooling, code reuse, build artefacts, and testing activity that indicates an adversary is maturing capability before deployment.
What Develop Capabilities Means in an Attack Lifecycle
Develop capabilities is the stage where an adversary turns intent into usable tradecraft. It covers building or adapting malware, exploit code, payloads, and supporting infrastructure so the operation can move from planning to execution.
This stage often sits between initial research and active deployment. What matters is not just whether code exists, but whether the actor can reliably run it, test it, and refine it for the target environment.
What Changes When Capability Development Begins
Once an adversary starts developing capabilities, the security problem shifts from generic threat awareness to evidence of preparation. Reuse of code, proof-of-concept modification, build artefacts, staging systems, and repeated testing all suggest the actor is reducing friction before a live campaign.
That matters because mature tooling usually increases reliability and scale. A capability that has been debugged, packaged, and operationalised is more likely to survive the first defensive control it encounters than a one-off experiment.
What Defenders Should Look For
Detection is strongest when you correlate development indicators rather than treating them in isolation. A single compile, script edit, or lab environment may be benign; a cluster of code changes, new hosting, repeated execution tests, and unusual repository activity is much more meaningful.
Defenders should also watch for tradecraft evolution over time, especially when the same actor shifts from public tooling to modified variants. MITRE ATT&CK Enterprise Matrix is useful for mapping those preparation and execution patterns to later-stage techniques, while NIST SSDF (SP 800-218) helps practitioners think about secure development discipline from the defender side when analysing software-like tradecraft.
Why This Stage Matters Operationally
Developed capability usually narrows the defender's window. If preparation is detected early, teams can harden likely targets, monitor adjacent infrastructure, and search for related activity before the payload is broadly used.
It also improves attribution and prioritisation. A simple scan is lower concern than a bespoke capability with environment-specific changes, test artefacts, and delivery infrastructure that matches the victim profile.
Risk and Threat Considerations
Capability development is risky because it creates the conditions for a more effective attack, including better payload reliability, stronger evasion, and repeatable deployment. It can also expose defenders to a longer pre-attack dwell period in which the adversary is quietly improving tooling and infrastructure.
Failure mechanism: The adversary iterates on code, infrastructure, and delivery until the tradecraft is stable enough to evade basic detection and operate at scale.
Impact: Once the capability is deployed, the resulting intrusion is often harder to stop, more repeatable, and more likely to include persistence or follow-on tooling.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while CIS Controls v8, NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1583 — Acquire Infrastructure | Capability development often includes staging infrastructure before deployment. |
| Recommendation — Map staging and delivery infrastructure to T1583 and hunt for preparatory activity across your telemetry. | ||
| CIS Controls v8 | CIS-10 — Malware Defenses | Developed payloads and malware-like tooling are directly addressed by malware defense controls. |
| Recommendation — Use CIS-10 to strengthen detection and containment for emerging malicious tooling. | ||
| NIST SP 800-53 Rev 5 | SI-4 — System Monitoring | Monitoring is needed to spot build, test, and staging behaviour that signals maturing attack capability. |
| AU-6 — Audit Record Review, Analysis, and Reporting | Reviewing logs helps connect scattered development indicators into a coherent threat picture. | |
| Recommendation — Apply SI-4 to detect anomalous development, testing, and deployment patterns linked to hostile activity. Use AU-6 to correlate build, execution, and infrastructure events that indicate attack preparation. | ||
| NIST CSF 2.0 | DE.CM-01 — Networks and network services are monitored to find potential cybersecurity events | Monitoring network and service activity supports early detection of infrastructure and testing related to attack prep. |
| Recommendation — Monitor network and service telemetry to surface infrastructure and testing activity tied to emerging threats. | ||
Practitioner Guidance
What to watch for: Treat code reuse, build artefacts, staging systems, and repeated test activity as early indicators of operational maturity, not just development noise. The most useful judgement is whether multiple small signals together show the actor is preparing to launch rather than merely experimenting.
Practitioner takeaway: The earlier you identify capability development, the more options you have to disrupt the campaign before a working payload reaches production targets.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 17, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org