The Pyramid of Pain is a prioritisation model that ranks indicators by how hard they are for an adversary to change. It pushes defenders toward higher-value detections such as techniques and behaviours, which tend to remain useful longer than hashes or IP addresses.
What the Pyramid of Pain changes in detection strategy
The Pyramid of Pain is useful because it shifts defenders away from low-friction indicators that attackers can replace quickly, and toward signals that expose how the intrusion actually works. The core idea is not just to detect more, but to detect at a level of attacker behaviour that is costlier to change and therefore more durable for defenders.
That makes the model especially relevant to detection engineering and threat intelligence programs that need to decide whether a rule, feed, or analytic is likely to survive basic adversary adaptation. Threat Intelligence Guide
Why some indicators age out quickly
Hashes, filenames, IP addresses, and domains can still be valuable, but they are often the easiest things for an adversary to rotate. Once a tactic becomes visible, the attacker can frequently swap infrastructure, recompile payloads, or use new delivery paths without changing the underlying tradecraft.
The Pyramid of Pain helps explain why a detection program built mainly on atomic indicators tends to decay faster than one that also captures behavioural patterns, toolmarks, and attack sequences. The same logic underpins indicator ageing and renewal work in threat intelligence operations. Indicators of Compromise vs Indicators of Attack Guide
Why techniques and behaviours are higher-value signals
At the top of the model, techniques and behaviours describe what an adversary is trying to do rather than a single artefact they are using at the moment. That is why detections mapped to TTPs tend to be more resilient, especially when they are tied to process chains, credential abuse patterns, privilege escalation, lateral movement, or repeated operational sequences.
This is also where the model overlaps with broader adversary knowledge bases: behavioural detections often survive changes in malware family, infrastructure, and payload packaging because the attacker still has to accomplish the same task. Pyramid of Pain Guide MITRE ATT&CK Enterprise Matrix
How defenders use the model in practice
The model is most useful as a prioritisation lens for detection engineering, hunt planning, and intelligence sharing. It encourages teams to ask whether a detection effort will merely catch today’s artefact, or whether it will expose a repeatable attacker method that remains useful across campaigns.
That is why feed quality is not just about volume. A high-value indicator set should contribute durable detections, enrich investigations, and improve retro-hunting even after the original observable has expired. Threat Intelligence Feed Evaluation Guide
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | TA0005 — Defense Evasion | Pyramid of Pain prioritises durable detections against attacker techniques and behaviours. |
| T1583 — Acquire Infrastructure | The model explains why infrastructure indicators are easier to change than attacker tradecraft. | |
| Recommendation — Map detections to ATT&CK techniques and hunt for repeated behavioural patterns, not just single indicators. Use ATT&CK infrastructure patterns to enrich intelligence and pivot from disposable indicators to tradecraft. | ||
| NIST CSF 2.0 | DE.CM-01 — Networks and environments are monitored to find potential cybersecurity events | The Pyramid of Pain guides what monitoring content to prioritise for longer-lived detections. |
| ID.RA-05 — Threats, vulnerabilities, likelihoods, and impacts are used to understand risk | The model is a risk-prioritisation lens for choosing higher-value indicators and analytics. | |
| Recommendation — Prioritise monitoring logic that detects enduring behaviours and not only short-lived atomic indicators. Use risk analysis to favour detections that create more attacker effort and longer analytic value. | ||
| CIS Controls v8 | CIS-8 — Audit Log Management | Behavioural detections depend on logs that reveal attacker actions rather than only artefacts. |
| Recommendation — Collect and centralise logs that let you detect attacker behaviour and validate analytic coverage. | ||
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 31, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org