Tactic-intent mapping

Expanded Definition

Tactic-intent mapping is an analytical method for translating observed adversary activity into the objective behind it. Rather than stopping at the surface description of an event, security teams ask whether the behaviour indicates concealment, credential theft, privilege escalation, persistence, lateral movement, disruption, or control interference. That shift matters because the same observable action can serve different goals depending on context. A failed login burst might be brute force, password spraying, or a diversion for another intrusion path.

In practice, the concept is closely related to threat modeling and detection engineering, but it is not identical to either. Threat models describe likely pathways, while tactic-intent mapping helps explain why a specific behaviour matters at the moment it is observed. The approach is especially useful in environments with layered telemetry, where analysts correlate endpoint, identity, network, and cloud signals before deciding what an adversary was trying to achieve. For AI-related threats, the same reasoning helps teams map behaviour to goals such as prompt manipulation, model evasion, data extraction, or agent misdirection, as reflected in the MITRE ATLAS adversarial AI threat matrix.

The most common misapplication is treating every suspicious action as the same intent, which occurs when teams classify incidents by alert label rather than by the adversary objective implied by the full sequence of activity.

Examples and Use Cases

Implementing tactic-intent mapping rigorously often introduces analysis overhead, requiring organisations to weigh faster triage against the time needed to validate what an adversary was likely trying to do.

• An endpoint process injects into a browser, which may look like generic malware activity but maps to credential interception if the surrounding telemetry shows session theft attempts.
• Repeated authentication failures can indicate password spraying, but the mapped intent may be account compromise, initial access, or diversion for another operation.
• A script disables logging, then modifies policy settings. That sequence may map to concealment and defense evasion rather than simple system tampering.
• In cloud environments, an unusual API call pattern may map to privilege expansion or data access even when the raw action appears to be routine administration.
• For AI systems, repeated tool-call retries or prompt rewriting can map to model manipulation or agent steering, a pattern increasingly discussed in adversarial AI analysis and in the MITRE ATLAS adversarial AI threat matrix.

Teams often pair this method with control-oriented baselines such as NIST SP 800-53 Rev 5 Security and Privacy Controls to determine whether the mapped intent aligns with failed or bypassed safeguards. The value is not just better storytelling; it is better validation. Analysts can test whether multiple alerts point to the same goal, whether a single noisy event is actually benign, or whether the sequence reveals a higher-impact objective than the initial detection suggested.

Why It Matters for Security Teams

Tactic-intent mapping helps security teams avoid two costly errors: overreacting to harmless noise and underreacting to behaviour that signals a serious attack path. When analysts focus only on the observable action, they may miss the adversary’s real objective and choose the wrong containment step. For example, a concealment tactic may need log preservation and hunting, while a privilege-gain tactic may require identity containment, session revocation, and control hardening. That distinction is also important for reporting, because executives and regulators need to understand impact in terms of objectives, not just event counts.

This is especially relevant in identity-heavy environments, where intent often emerges through misuse of credentials, tokens, or delegated access. It also matters for AI and agentic systems, where an autonomous agent can become part of the attack path if its tool access is manipulated. Security teams can use intent mapping to align detections with control outcomes in NIST SP 800-53 Rev 5 Security and Privacy Controls and to improve adversarial AI triage with MITRE ATLAS adversarial AI threat matrix.

Organisations typically encounter the full cost of poor tactic-intent mapping only after an intrusion has been contained incompletely, at which point the same attacker objective reappears through a different technique and becomes operationally unavoidable to address.

Related resources from NHI Mgmt Group

• What is the difference between logging actions and logging intent for AI agents?
• What is the difference between role-based access and intent-based access for agents?
• What is the difference between RBAC and intent-aware access for autonomous workflows?
• What is the difference between access control and intent governance for AI agents?