ATT&CK tells defenders what adversaries do, but most teams never use the mitigation layer that says which controls address it, so control investment and threat coverage are planned separately. MITRE ATT&CK Enterprise v20 defines 44 mitigations, numbered M1013 to M1060, described by MITRE as security concepts and classes of technologies that can prevent a technique or sub-technique from being executed. This hub lists all 44 in six families with a link to each mitigation guide, explains the two special entries M1055 Do Not Mitigate and M1056 Pre-compromise, and ranks the mitigations by how many techniques they map to, computed from the v20 data. It also shows how to turn that ranking into priorities and how the mitigations relate to MITRE D3FEND. It is for security architects, detection engineers and security leaders building a threat-informed control roadmap.
Key takeaways
- 44 mitigations, 1,477 relationships. In ATT&CK v20 the 44 enterprise mitigations hold 1,477 current "mitigates" relationships to 595 of the 706 active techniques and sub-techniques; 111 have no mitigation at all.
- Coverage is concentrated. Ranked by mapped techniques, User Account Management, Privileged Account Management and Audit each map to more than 110 techniques and sub-techniques, and a greedy selection of five mitigations reaches 68% of the techniques that have an operational mitigation.
- Identity controls lead. The seven identity and access mitigations together map to 220 techniques and sub-techniques, 44% of everything with an operational mitigation, which is why account and credential hygiene sits at the top of most threat-informed roadmaps.
- A mapping is not a guarantee. ATT&CK says a mitigation can help against a technique; whether it does depends on implementation depth, and counts say nothing about effectiveness.
- Two entries are not controls. M1055 Do Not Mitigate flags techniques where preventive controls are inadvisable, and M1056 Pre-compromise groups activity that happens outside the network, mostly reconnaissance and resource development.
How ATT&CK mitigations work
Each mitigation is a STIX "course-of-action" object linked to techniques by "mitigates" relationships. Every relationship carries its own usage text explaining how the mitigation applies to that technique, and the text differs per technique: M1057 Data Loss Prevention, for example, says DLP can detect sensitive data copied to USB for one technique and sensitive data uploaded through browsers for another. That usage text, not the mitigation name, is what a control owner should implement against.
| Property | What it means in practice |
|---|---|
| Granularity | Mitigations are broad classes (for example, Execution Prevention), not products or settings; each needs translating into concrete configuration |
| Many-to-many | A mitigated technique in v20 has on average 2.5 mitigations; a mitigation can map to over 100 techniques |
| Sub-technique mapping | Relationships often target sub-techniques, so counting only base techniques undercounts coverage |
| Prevention focus | Mitigations describe prevention and reduction; detection is modelled separately through detection strategies and analytics |
| Versioned | Mappings change between ATT&CK releases; pin the version you report against |
For detection coverage, see the ATT&CK Detection Strategies and Analytics Guide. For an introduction to the framework, see the MITRE ATT&CK Guide for Defenders.
All 44 mitigations by family
ATT&CK does not group its mitigations. The six families below are an NHI Mgmt Group grouping by the team that usually owns the control. Counts are current techniques and sub-techniques each mitigation maps to in ATT&CK v20 (revoked and deprecated objects excluded).
Identity and access
| ID | Mitigation | What it covers | Techniques and sub-techniques mapped (v20) |
|---|---|---|---|
| M1015 | Active Directory Configuration | Group Policy and directory settings that harden accounts, trusts and Kerberos | 15 |
| M1018 | User Account Management | Account lifecycle, least privilege and permissions for user and cloud accounts | 123 |
| M1026 | Privileged Account Management | Restricting, separating and monitoring administrator, root and service accounts | 115 |
| M1027 | Password Policies | Length, reuse and storage rules for passwords | 47 |
| M1032 | Multi-factor Authentication | Requiring two or more factors for sign-in and sensitive actions | 48 |
| M1036 | Account Use Policies | Lockout, logon restrictions and conditional rules on how accounts are used | 12 |
| M1043 | Credential Access Protection | Protecting credential stores such as LSASS from being read | 10 |
Endpoint and execution control
| ID | Mitigation | What it covers | Techniques and sub-techniques mapped (v20) |
|---|---|---|---|
| M1025 | Privileged Process Integrity | Protecting high-privilege processes from tampering and injection | 7 |
| M1033 | Limit Software Installation | Allowlisting and blocking installation of unapproved software | 17 |
| M1034 | Limit Hardware Installation | Blocking unapproved USB and peripheral hardware | 7 |
| M1038 | Execution Prevention | Application control and script blocking so only approved code runs | 82 |
| M1040 | Behavior Prevention on Endpoint | Endpoint rules that block suspicious process and API behaviour | 51 |
| M1044 | Restrict Library Loading | Ensuring only trusted libraries and DLLs load | 3 |
| M1045 | Code Signing | Signing and enforcing signatures on executables, scripts and drivers | 22 |
| M1046 | Boot Integrity | Secure Boot and measured boot integrity of firmware and loaders | 14 |
| M1048 | Application Isolation and Sandboxing | Running code in sandboxes, containers or isolated environments | 15 |
| M1049 | Antivirus/Antimalware | Signature and heuristic malware detection and removal | 23 |
| M1050 | Exploit Protection | Exploit mitigations that block memory corruption and exploit behaviour | 12 |
| M1052 | User Account Control | Windows UAC prompts and settings that limit silent elevation | 7 |
System and software hardening
| ID | Mitigation | What it covers | Techniques and sub-techniques mapped (v20) |
|---|---|---|---|
| M1016 | Vulnerability Scanning | Scanning systems and applications for weaknesses and misconfiguration | 5 |
| M1022 | Restrict File and Directory Permissions | File system access controls on sensitive files and directories | 63 |
| M1024 | Restrict Registry Permissions | Access controls on sensitive Windows registry keys | 20 |
| M1028 | Operating System Configuration | Hardening operating system settings and defaults | 39 |
| M1039 | Environment Variable Permissions | Preventing unauthorised changes to environment variables | 2 |
| M1042 | Disable or Remove Feature or Program | Removing or disabling unneeded features, services and programs | 72 |
| M1051 | Update Software | Patching operating systems and applications | 42 |
| M1054 | Software Configuration | Security settings in applications, middleware, SaaS and cloud services | 36 |
Network
| ID | Mitigation | What it covers | Techniques and sub-techniques mapped (v20) |
|---|---|---|---|
| M1020 | SSL/TLS Inspection | Decrypting and inspecting TLS traffic for malicious content | 4 |
| M1021 | Restrict Web-Based Content | Web filtering, download controls and browser restrictions | 31 |
| M1030 | Network Segmentation | Dividing networks to limit reachability and lateral movement | 38 |
| M1031 | Network Intrusion Prevention | Signature-based blocking of malicious network traffic | 62 |
| M1035 | Limit Access to Resource Over Network | Restricting access to shares, remote services and resources to those who need them | 19 |
| M1037 | Filter Network Traffic | Ingress, egress and internal firewall and protocol filtering | 52 |
Data protection and recovery
| ID | Mitigation | What it covers | Techniques and sub-techniques mapped (v20) |
|---|---|---|---|
| M1029 | Remote Data Storage | Moving logs and critical data off the host to protected storage | 11 |
| M1041 | Encrypt Sensitive Information | Encrypting data at rest, in transit and in use | 33 |
| M1053 | Data Backup | Taking and protecting backups for recovery | 10 |
| M1057 | Data Loss Prevention | Classifying and controlling movement of sensitive data | 12 |
People, process and visibility
| ID | Mitigation | What it covers | Techniques and sub-techniques mapped (v20) |
|---|---|---|---|
| M1013 | Application Developer Guidance | Secure coding and design guidance for developers | 17 |
| M1017 | User Training | Training staff to recognise and report social engineering | 64 |
| M1019 | Threat Intelligence Program | Using threat intelligence to inform defences | 5 |
| M1047 | Audit | Recording and reviewing activity and configuration | 111 |
| M1060 | Out-of-Band Communications Channel | Separate channels for verification and incident communications | 7 |
M1055 Do Not Mitigate
M1055 is a flag, not a control. ATT&CK describes it as highlighting scenarios where attempting to mitigate a technique may increase security risk or operational instability, and lists four situations: complex systems where mitigation is risky (its example is legacy industrial control systems), mitigations that reduce the coverage of other controls, mitigations that introduce new vulnerabilities (its example is disabling certificate validation), and mitigations that harm performance or availability. In those cases ATT&CK points to detection, monitoring or response instead.
In ATT&CK v20, M1055 maps to three entries, all in the Stealth tactic: T1480 Execution Guardrails, T1480.001 Environmental Keying and T1480.002 Mutual Exclusion. These are the only techniques whose sole mitigation is M1055. ATT&CK's reasoning is that guardrails stop malware running on unintended targets, so preventing them could widen harm, and that environmental keying has no standard attributes to block. Its advice is to focus on preventing adversary tools from running earlier in the chain and on detecting the behaviour that follows. For control owners, M1055 is also a useful pattern: document deliberate decisions not to mitigate, with the compensating detection, rather than leaving the gap unexplained.
M1056 Pre-compromise
M1056 groups measures against activity that happens before and outside the victim network. The mitigation page (version 1.1, last modified 12 May 2026) lists limiting public information exposure, protecting domain and DNS infrastructure (DNSSEC, monitoring for lookalike domains), monitoring the external attack surface, threat intelligence, email and content protections including SPF, DKIM and DMARC, and training on phishing and information leaks. Its own text names example tools; this hub does not reproduce product names.
In the v20 data M1056 maps to 89 techniques and sub-techniques, all in Reconnaissance (TA0043) and Resource Development (TA0042), and 88 of them have no other mitigation. The live page showed 90 entries when checked in November 2026, reflecting its May 2026 update. That is the practical meaning of M1056: an organisation cannot stop an adversary registering domains (T1583 Acquire Infrastructure) or gathering staff details (T1589 Gather Victim Identity Information), but it can reduce what is exposed and watch for preparation. D3FEND relates M1056 to Decoy Environment (D3-DE) and Decoy Object (D3-DO). See the ATT&CK Resource Development Tactic Guide and M1019 Threat Intelligence Program.
Which mitigations cover the most techniques
Method: from the ATT&CK Enterprise v20 STIX bundle, count current "mitigates" relationships per mitigation, excluding revoked or deprecated relationships, techniques and mitigations. Sub-techniques count separately. Tactic breadth is the number of the 15 v20 tactics in which the mapped techniques appear.
| Rank | Mitigation | Techniques and sub-techniques | Of which base techniques | Tactics touched (of 15) |
|---|---|---|---|---|
| 1 | M1018 User Account Management | 123 | 52 | 12 |
| 2 | M1026 Privileged Account Management | 115 | 41 | 10 |
| 3 | M1047 Audit | 111 | 39 | 12 |
| 4 | M1056 Pre-compromise | 89 | 19 | 2 |
| 5 | M1038 Execution Prevention | 82 | 24 | 8 |
| 6 | M1042 Disable or Remove Feature or Program | 72 | 27 | 13 |
| 7 | M1017 User Training | 64 | 26 | 12 |
| 8 | M1022 Restrict File and Directory Permissions | 63 | 21 | 10 |
| 9 | M1031 Network Intrusion Prevention | 62 | 26 | 10 |
| 10 | M1037 Filter Network Traffic | 52 | 22 | 11 |
| 11 | M1040 Behavior Prevention on Endpoint | 51 | 16 | 8 |
| 12 | M1032 Multi-factor Authentication | 48 | 19 | 11 |
At the other end, M1039 Environment Variable Permissions (2), M1044 Restrict Library Loading (3) and M1020 SSL/TLS Inspection (4) map to the fewest. A low count does not make a mitigation unimportant: narrow mitigations often address techniques nothing else covers.
Marginal coverage
Raw counts overlap heavily. A greedy selection, choosing at each step the mitigation that adds the most not-yet-covered techniques, gives a better view of where breadth comes from. Excluding M1055 and M1056, 504 techniques and sub-techniques have at least one operational mitigation.
| Mitigations selected | Techniques covered | Share of 504 |
|---|---|---|
| 3 (M1018, M1026, M1038) | 255 | 51% |
| 5 (adds M1031, M1047) | 342 | 68% |
| 8 (adds M1040, M1022, M1042) | 407 | 81% |
| 10 (adds M1017, M1037) | 432 | 86% |
| 15 | 466 | 92% |
| 20 | 485 | 96% |
| 30 | 504 | 100% |
Where no mitigation exists
111 active techniques and sub-techniques have no mitigation in v20. Counted by tactic (a technique can sit in more than one), they are concentrated in Discovery (35) and Stealth (33), followed by Persistence and Privilege Escalation (15 each) and Collection (13). Examples include T1020 Automated Exfiltration as a base technique. These rely on detection, so the gap list is a direct input to detection engineering. See the ATT&CK Stealth and Defense Impairment Tactics Guide.
How to prioritise mitigations
Technique counts are a starting point, not a plan. NHI Mgmt Group recommends this sequence.
- Pick your techniques first. Use threat intelligence on the groups and campaigns relevant to your sector to select the techniques that matter, then pull the mitigations mapped to them. A mitigation that covers 100 techniques you do not face is worth less than one that covers the five you do.
- Weight by breadth and overlap. Among the mitigations your techniques need, start with those that add the most uncovered techniques (the greedy view above), which usually means the identity and access family.
- Assess implementation depth, not presence. Score each mitigation against the per-technique usage text: MFA deployed for staff but not for service accounts, or Audit enabled but not reviewed, does not cover the mapped techniques.
- Close no-mitigation gaps with detection. For the 111 unmitigated techniques and those marked M1055, assign detection coverage instead.
- Treat M1056 as exposure management. Fund it through attack surface monitoring, domain protection and threat intelligence rather than internal controls.
- Re-run on each ATT&CK release. Pin a version, recompute counts and mappings, and record changes.
| Organisation | Practical starting set | Why |
|---|---|---|
| Small, cloud and SaaS heavy | M1032, M1018, M1026, M1054, M1051, M1053 | Identity and configuration of hosted services carry most of the risk; backups for recovery |
| Mid-size, mixed estate | Above plus M1038, M1047, M1037, M1042, M1017 | Adds endpoint control, logging, egress filtering and attack surface reduction |
| Large or regulated | Above plus M1030, M1031, M1040, M1041, M1057, M1060 | Segmentation, network prevention, behavioural endpoint controls, data protection and response resilience |
Where identity fits
Most of the top-ranked mitigations are identity controls, and their ATT&CK usage text already reaches machine identities: M1026 text refers to service accounts with administrative privileges, and M1018 maps to cloud account techniques with least privilege guidance for IAM policies. In practice that means extending M1018, M1026, M1032 and M1036 beyond staff accounts to workload identities, API keys and OAuth applications, where MFA does not apply and least privilege, short-lived credentials and ownership have to do the work. A mitigation that covers only human accounts leaves the machine path through the same technique open. See the MITRE ATT&CK T1078 Valid Accounts Guide for the most widely mitigated identity technique in practice.
How mitigations relate to D3FEND
MITRE D3FEND models defensive techniques at a finer grain than ATT&CK mitigations and publishes an explicit "related" link from ATT&CK mitigations to D3FEND countermeasures. In the D3FEND ontology file used for this guide, 42 enterprise mitigations (M1013 to M1056) are represented; 35 of them carry related links to 57 distinct D3FEND techniques. M1013, M1016, M1017, M1019, M1029, M1053 and M1055 have none, and the two newest mitigations, M1057 and M1060, are not yet represented.
| ATT&CK mitigation | Related D3FEND techniques (from the D3FEND ontology) |
|---|---|
| M1038 Execution Prevention | Driver Load Integrity Checking, Executable Allowlisting (D3-EAL), Executable Denylisting, Process Segment Execution Prevention |
| M1040 Behavior Prevention on Endpoint | Eight analytics, including Authentication Event Thresholding, Resource Access Pattern Analysis and User Data Transfer Analysis (D3-UDTA) |
| M1041 Encrypt Sensitive Information | Disk Encryption, Encrypted Tunnels, File Encryption, Message Encryption (D3-MENCR) |
| M1021 Restrict Web-Based Content | DNS Allowlisting, DNS Denylisting, File Analysis, Inbound and Outbound Traffic Filtering (D3-OTF), Network Traffic Analysis (D3-NTA), URL Analysis |
| M1028 Operating System Configuration | Platform Hardening (D3-PH) |
| M1035 and M1037 | Network Isolation (D3-NI) |
System Call Filtering (D3-SCF) is the most shared countermeasure, related to six mitigations (M1018, M1025, M1042, M1044, M1048 and M1052). Use D3FEND to turn a broad mitigation into specific, testable techniques, and ATT&CK to decide which mitigations matter. See the MITRE D3FEND Guide.
Measuring mitigation coverage
- Mitigation implementation score: for each of the 42 operational mitigations, a rating of implementation depth against its per-technique usage text.
- Technique coverage: share of your priority techniques with at least one mitigation rated implemented and tested.
- Gap register: priority techniques with no mitigation, each with a named detection and owner.
- Identity extension: share of identity mitigations applied to non-human identities as well as staff.
- Version currency: ATT&CK version your mapping uses versus the current release.
The MITRE ATT&CK Coverage Mapping Guide covers building and visualising the coverage map.
Common failure patterns
- Counting names, not implementations. A tool that "does MFA" is recorded as M1032 coverage across 48 techniques, while service accounts and legacy protocols remain exempt.
- Ranking by raw count alone. Teams fund the top of the count table and ignore narrow mitigations that cover their actual threats.
- Treating M1056 as internal hardening. Pre-compromise budget goes to internal controls that cannot see reconnaissance.
- Silent M1055 decisions. Choosing not to mitigate is reasonable; not recording the compensating detection is not.
- Stale versions. Mappings are built on an old ATT&CK release and still cite revoked techniques.
Practitioner checklist
- Pin the ATT&CK version you map against and record it in reports.
- Select priority techniques from threat intelligence before choosing mitigations.
- Score each mitigation by implementation depth against its usage text.
- Start with identity and access mitigations, extended to non-human identities.
- Use greedy marginal coverage, not raw counts, to sequence investment.
- Assign detection to every unmitigated and M1055 technique in scope.
- Run M1056 as external exposure management with threat intelligence.
- Use D3FEND related techniques to make each mitigation testable.
- Recompute coverage on each ATT&CK release.
Standards and references
- MITRE ATT&CK: Enterprise Mitigations
- MITRE ATT&CK: Do Not Mitigate (M1055)
- MITRE ATT&CK: Pre-compromise (M1056)
- MITRE ATT&CK: ATT&CK STIX Data (Enterprise v20)
- MITRE D3FEND: A Knowledge Graph of Cybersecurity Countermeasures
- MITRE ATT&CK: Execution Guardrails (T1480)
Related NHI Mgmt Group resources: MITRE ATT&CK Guide for Defenders, MITRE ATT&CK Coverage Mapping Guide, MITRE D3FEND Guide, MITRE ATLAS Mitigations Guide.