MITRE ATLAS vs MITRE ATT&CK: What Security Teams Must Add for AI Systems

For more than a decade, MITRE ATT&CK has been the common language of security operations. Detection rules, red team reports, threat intelligence and board dashboards are all mapped to its tactics and techniques. But ATT&CK was built around hosts, accounts and networks. It was never designed for an attacker who poisons training data, extracts a model through its API, or hides instructions in a web page that an AI agent will read and obey.

That's the gap MITRE ATLAS (Adversarial Threat Landscape for Artificial-Intelligence Systems) fills. In October 2026, both frameworks shipped major releases in the same month. ATT&CK v20 added its first Enterprise techniques aimed directly at AI systems, including prompt injection. ATLAS v2026.10 grew to 129 techniques, most of them relevant to agentic AI.

This guide explains what each framework covers, where they overlap, what ATT&CK still misses, and the practical steps a security team should take to add ATLAS to an existing ATT&CK-based programme.

The short answer

Keep ATT&CK as your backbone and add ATLAS for every system that trains, hosts, calls or relies on an AI model. ATT&CK covers how attackers reach and abuse the infrastructure around AI: the cloud accounts, the build pipelines, the endpoints and the credentials. ATLAS covers how they attack the AI itself: its data, its model, its prompts, its tools and its autonomy.

ATT&CK v20 narrowed the gap but didn't close it. It now names prompt injection and AI-enabled exfiltration, but techniques such as training data poisoning, model extraction, adversarial evasion of classifiers and agent tool poisoning still live only in ATLAS.

What MITRE ATT&CK covers in 2026

ATT&CK catalogues tactics (the adversary's goal), techniques (how they achieve it) and sub-techniques, built from observed real-world attacks. It also profiles threat groups, software and campaigns, and since 2025 it has shipped detection strategies with platform-specific analytics.

Two releases in 2026 reshaped it. ATT&CK v19 (28 April 2026) retired Defense Evasion, the framework's most heavily used tactic, and split it into Stealth and Defense Impairment, taking Enterprise from 14 to 15 tactics. ATT&CK v20 (13 October 2026) added nine Enterprise techniques and sub-techniques, and five of them concern AI:

That's a meaningful signal: AI attacks are now common enough to be classed as mainstream enterprise behaviour. But five techniques against a whole AI attack surface is a starting point, not full coverage.

What MITRE ATLAS covers in 2026

ATLAS uses the same matrix model as ATT&CK: tactics, techniques, sub-techniques, mitigations and case studies. But every entry describes behaviour against AI-enabled systems. It draws on real incidents, red team exercises and security research, and MITRE now publishes updates roughly monthly.

Its 16 tactics include 14 adapted from ATT&CK, such as Reconnaissance, Initial Access, Persistence, Exfiltration and Impact, plus two that have no ATT&CK equivalent:

• AI Model Access: how adversaries gain access to a model, through an inference API, a product that embeds it, physical access or direct access to model artefacts
• AI Attack Staging: how adversaries prepare an attack tailored to a target model, such as building proxy models, crafting adversarial data or verifying an attack offline. Recent releases list it as AI Attack Adaptation.

Since May 2026, every ATLAS technique has also carried a platform tag (Predictive AI, Generative AI, Agentic AI or Enterprise), so teams can filter the matrix down to the systems they actually run. Agentic AI is now the most common tag. In release v2026.09, 139 of 208 technique and sub-technique entries carried it.

Technique counts exclude sub-techniques. Because ATLAS ships monthly, always cite the release version alongside any figure.

The case studies are what make ATLAS practical. Recent additions include data exfiltration through a poisoned MCP server, data destruction via indirect prompt injection against a computer-use agent, a malicious AI agent found in a coding-assistant extension, and model distillation campaigns targeting commercial AI models. Each one is mapped step by step to ATLAS techniques.

Why security teams can't rely on ATT&CK alone

The threat has moved from the lab to production. CrowdStrike's 2026 Global Threat Report recorded an 89% year-on-year rise in AI-enabled adversary attacks, and found adversaries had injected malicious prompts into legitimate generative AI tools at more than 90 organisations. IBM's 2025 Cost of a Data Breach report found that 13% of organisations had suffered an attack on their AI models or applications, and 97% of those lacked proper AI access controls.

Most SOCs can't see these attacks because their detections are mapped only to ATT&CK. A model being slowly extracted through thousands of legitimate-looking API queries, a poisoned dataset entering a training pipeline, or an agent quietly following instructions buried in a support ticket generate none of the endpoint, network or identity signals ATT&CK detections are built to catch.

If you are adding AI threats to your detection and threat modelling programme, I post practical breakdowns of MITRE ATLAS, OWASP's AI lists and ISO 42001 regularly on LinkedIn. Feel free to connect with me there and tell me which AI attack your team is most worried about.

MITRE ATLAS vs MITRE ATT&CK: side by side

What ATLAS adds that ATT&CK still doesn't cover

Even after v20, these attack categories are covered in depth only by ATLAS:

How to add ATLAS to an ATT&CK-based programme: 6 steps

1. Inventory your AI attack surface

   List every model, AI API, RAG pipeline, agent, MCP server and AI-enabled SaaS tool in use, including shadow AI. Tag each one as predictive, generative or agentic so you can filter ATLAS to match.

2. Threat model each AI system with both matrices

   Use ATT&CK for the infrastructure and identities around the system, and ATLAS for the data, model, prompts and tools. Use ATLAS case studies as ready-made attack chains to test against.

3. Build one combined coverage map

   Use the ATT&CK and ATLAS Navigators side by side, align overlapping techniques such as prompt injection, and record which detections, controls or gaps apply to each technique.

4. Add AI telemetry to the SOC

   Log prompts and responses, tool calls, agent actions, model API usage, model registry changes and training data provenance. Without these logs, ATLAS techniques are invisible.

5. Red team against ATLAS techniques

   Test priority techniques such as indirect prompt injection, model extraction, agent tool poisoning and jailbreaks, and map every finding to its ATLAS ID in reports.

6. Track releases and link to governance

   Review ATLAS monthly and ATT&CK twice a year. Feed results into your AI risk register under ISO/IEC 42001, the NIST AI RMF or the EU AI Act, so technical findings reach governance decisions.

Common mistakes to avoid

• Assuming ATT&CK v20's five AI techniques mean you now have AI coverage
• Treating ATLAS as a research catalogue rather than an operational framework
• Threat modelling the model while ignoring the cloud, identity and pipeline around it
• Quoting ATLAS figures without a release version, when they change every month
• Running AI red teams without mapping findings to ATLAS, which leaves them hard to track or compare

A prompt to map an AI system to ATLAS and ATT&CK

Paste in your system details to get a first-draft threat model. Your security architect should validate the technique IDs against the current ATLAS and ATT&CK releases.

You are an AI security architect with deep knowledge of MITRE
ATLAS (release v2026.10) and MITRE ATT&CK Enterprise (v20).

Our AI system:
[purpose; model type (predictive, generative, agentic); model
source (in-house, open-weight, API provider); data sources and
RAG stores; tools, plugins or MCP servers the agent can call;
who can access it and how; hosting environment; current logging
and security controls]

Produce:
1. A list of likely attack paths, each as an ordered chain of
   ATT&CK and ATLAS tactics and techniques with IDs.
2. A table of the top 15 ATLAS techniques relevant to this
   system, with likelihood, impact and existing controls.
3. The ATLAS case studies most similar to our system and what
   they teach us.
4. The telemetry we need to detect each priority technique.
5. Mitigations from ATLAS and ATT&CK, ranked by risk reduction.
6. A red team test plan covering the five highest-risk
   techniques.

Use only what I provide and mark uncertain points UNKNOWN.
Flag any technique ID I should verify against the live matrix.

ATT&CK protects the house AI lives in. ATLAS protects the mind inside it. Attackers are already targeting both, so your detections need to cover both. — Kumail Mehdi

Frequently asked questions

Building AI threat models or AI red team programmes? Let's connect on LinkedIn. I'm always happy to compare notes on securing AI systems.

Sources

• MITRE ATLAS — Adversarial Threat Landscape for AI Systems
• MITRE ATLAS — Release v2026.10 (atlas-data on GitHub)
• MITRE ATT&CK
• SecurityWeek — MITRE ATT&CK v20 catalogs AI abuse, MFA bypass and water utility attacks
• Cyber Security News — ATT&CK v20 adds 9 new techniques
• Brandefense — ATT&CK v20 Enterprise counts
• MITRE ATT&CK blog — ATT&CK v19 and the Defense Evasion split
• Speakeasy — MITRE ATLAS is now an agent security framework (v2026.09)
• Aperion — MITRE ATLAS platform designations and 2026 releases
• Ronald Bradford — MITRE ATLAS growth since 2021
• Stingrai — AI attack surface analysis 2026 (CrowdStrike and IBM figures)
• IBM — 2025 Cost of a Data Breach: navigating AI