MA
Uploaded byMITRE ATT&CK
PDF, PPTX574 views

ATT&CK Metaverse - Exploring the Limitations of Applying ATT&CK

The document presents a talk by Gert-Jan Bruggink on the ATT&CK framework in the context of cybersecurity, emphasizing its evolution, adoption, and usage among organizations. It highlights the disparities in how different sectors utilize the framework, identifies common usage challenges, and suggests methods for enhancing its application to improve storytelling and risk management. The future of ATT&CK relies on community involvement, feedback, and technological support to refine its effectiveness and relevance.

Embed presentation

Download as PDF, PPTX
@gertjanbruggink ATT&CK ‘Metaverse’ Exploring the limitations of applying ATT&CK Gert-Jan Bruggink ATT&CKCON 3.0 29 & 30 March 2022
@gertjanbruggink 2 Why am I here? § A cyber security ‘metaverse’ § Lessons from the limitations § Practitioner feedback
@gertjanbruggink 3 Who am I? Gert-Jan Bruggink cyber threat cartographer & founder Venation 10+ InfoSec. High tech, manufacturing, financial services, governmental. Cyber threat intelligence (CTI) based risk management. Intelligence-led Red Teaming. Capability building & leadership. Strategic change through (CTI, SOC & Cyber) transformation programs. Father x 2, Entrepreneurship, Gaming, Painting, Lego, Meme’s. @gertjanbruggink github.com/gertjanbruggink /gertjanbruggink
@gertjanbruggink 4 What am I going to talk about? ü Evolution & lessons learned ü Adoption & lessons learned ü Usage & lessons learned
@gertjanbruggink Evolution
@gertjanbruggink The terrifying ‘first look’ at ATT&CK 🌱 ~2015 🧰 188 techniques, 379 sub (Enterprise) 📈 ~2022 🔨 Many supporting tools 6 🧰 96 techniques 👨‍ Matrix expansions 🔮 ~2025?
@gertjanbruggink Constant expansion and structuring ☁ Cloud 🏭 ICS 📱 Mobile 💕 Base set (Enterprise) 7 📷 PRE (*RIP* - still love you!)
@gertjanbruggink 8 Storytelling using ATT&CK 🎣 Freshness of new content 📖 Narrative 🧠 Required comprehension of the framework 🧩 Assumption of completeness
@gertjanbruggink adoption
@gertjanbruggink 10 ‘how-many-teams-actually-use-ATT&CK’ bias Perceived & assumed true adoption Perceived true adoption ~ Enterprise sized companies ~ Small-medium sized companies Do not assume everyone is using the framework - or uses it in the intended way Research paper “ABC”: 80-100% companies use ATT&CK 🤨
@gertjanbruggink Where is the adoption (more-or-less) 🏦 Private sector 🤝 Vendor & consulting 🎱 🏀 Company size matters 🏫 Public sector 11 👩🏭 ‘Business as usual’ vs ad-hoc
@gertjanbruggink 12 Applications outside of operations 🧱 Basics vs details 🤯 Rethinking risk management 🎯 Not everyone can work with minute details 🔬 Granular risk management
@gertjanbruggink 13 Main motivation usecase: prioritization 🧭 Left-or-right? 🧙 Other ways of telling the story (ATT&CKonomics) ✅ Scoping 🚦 Navigator
@gertjanbruggink Usage
@gertjanbruggink Setting the scene: example starting points Teams new to ATT&CK § How does the framework help me tell a better story to my leadership? § Can we use the framework to help us do basics better? § Will using it save us costs along the way? 15 Teams seasoned in using ATT&CK § Where will the framework give better context/nuance in attacks against similar companies? § What test scenarios should be prioritized when validation controls with our capabilities (e.g. hunting, red teaming)? § Can you prepare a cost-effectiveness assessment of our controls, compared to adversaries (and techniques) targeting our vertical?
@gertjanbruggink 16 The dreaded ‘bingo card’ visuals 🌄 Happy little threat landscapes 📊 ATT&CK is not sexy 👨‍ First impressions do matter 🎨 Creative coverage reporting
@gertjanbruggink Consolidation… 💩 (Dreaded) local customizations 🧼 Staying relevant 🍎🍐 Relationship to other frameworks 🧬 Maintaining a central data model 17
@gertjanbruggink The ‘TTP’* discussion 🎭 Biases & logical fallacies 🧠 General understanding of the ‘TTP’ concept ⌚ ‘Procedure’ catch 22 🧭 Staying high- level 18 *Tactics, Techniques and Procedures
@gertjanbruggink 19 Engineering your hypotheses 🧫 Success: lab vs real world 💡 Creation and prioritization 🚵 Behavioral engineering vs … 🧗 Context matters! 🔊 Data sources
@gertjanbruggink Building scenarios to provide context 🌐 ATT&CK as a metaverse? 👾 Adversary playbooks 🕑 Timing & timestamping 📍 Scenario sequencing 20 🎣 Fresh
@gertjanbruggink Validating scenarios 21 🎠 Automatically ✅ Validation 🎨 Creativity 🧤 Manually 🥇 Value of testing specific techniques 📑 Reporting added value
@gertjanbruggink The future of ATT&CK remains the community 👬 People (e.g. continue expanding the education the ‘adopting’ community) 🎢 Process (e.g. sharing feedback) 🦾 Technology (e.g. vendor ecosystem) 22
@gertjanbruggink 23 Recap & course of action § Don’t complain, just provide feedback. § Contribute == getting creds § The community decides ATT&CK direction: this is widely underestimated. If you would revisit our ATT&CK usage today: ü What is our level of (true) adoption of the framework? ü How are we telling the right, nuanced, story - from procedure- to board room? Consider today
@gertjanbruggink Let’s continue expanding the ATT&CK ‘metaverse’! Gert-Jan Bruggink gertjanbruggink@venation.digital @gertjanbruggink /gertjanbruggink

More Related Content

PDF
Would you Rather Have Telemetry into 2 Attacks or 20? An Insight Into Highly ...
byMITRE ATT&CK
 
PDF
The ATT&CK Latin American APT Playbook
byMITRE ATT&CK
 
PDF
It's just a jump to the left (of boom): Prioritizing detection implementation...
byMITRE ATT&CK
 
PDF
Projects to Impact- Operationalizing Work from the Center
byMITRE ATT&CK
 
PDF
State of the ATT&CK
byMITRE ATT&CK
 
PDF
ATT&CK Updates- Defensive ATT&CK
byMITRE ATT&CK
 
PDF
What is ATT&CK coverage, anyway? Breadth and depth analysis with Atomic Red Team
byMITRE ATT&CK
 
PDF
ATT&CKing the Red/Blue Divide
byMITRE ATT&CK
 
Would you Rather Have Telemetry into 2 Attacks or 20? An Insight Into Highly ...
byMITRE ATT&CK
 
The ATT&CK Latin American APT Playbook
byMITRE ATT&CK
 
It's just a jump to the left (of boom): Prioritizing detection implementation...
byMITRE ATT&CK
 
Projects to Impact- Operationalizing Work from the Center
byMITRE ATT&CK
 
State of the ATT&CK
byMITRE ATT&CK
 
ATT&CK Updates- Defensive ATT&CK
byMITRE ATT&CK
 
What is ATT&CK coverage, anyway? Breadth and depth analysis with Atomic Red Team
byMITRE ATT&CK
 
ATT&CKing the Red/Blue Divide
byMITRE ATT&CK
 

What's hot

PDF
ATT&CKcon Intro
byMITRE ATT&CK
 
PDF
The ATT&CK Philharmonic
byMITRE ATT&CK
 
PDF
Mapping ATT&CK Techniques to ENGAGE Activities
byMITRE ATT&CK
 
PDF
Threat Modelling - It's not just for developers
byMITRE ATT&CK
 
PDF
Mapping to MITRE ATT&CK: Enhancing Operations Through the Tracking of Interac...
byMITRE ATT&CK
 
PDF
Exploring how Students Map Social Engineering Techniques to the ATT&CK Framew...
byMITRE ATT&CK
 
PPTX
Putting MITRE ATT&CK into Action with What You Have, Where You Are
byKatie Nickels
 
PDF
Tracking Noisy Behavior and Risk-Based Alerting with ATT&CK
byMITRE ATT&CK
 
PDF
MITRE ATT&CKcon 2.0: Using Threat Intelligence to Focus ATT&CK Activities; Da...
byMITRE - ATT&CKcon
 
PDF
ATT&CK Updates- ATT&CK's Open Source
byMITRE ATT&CK
 
PDF
ATT&CK Updates- ATT&CK for ICS
byMITRE ATT&CK
 
PDF
MITRE ATT&CKcon 2018: Hunters ATT&CKing with the Data, Roberto Rodriguez, Spe...
byMITRE - ATT&CKcon
 
PDF
Intelligence Failures of Lincolns Top Spies: What CTI Analysts Can Learn Fro...
byMITRE ATT&CK
 
PDF
ATT&CKING Containers in The Cloud
byMITRE ATT&CK
 
PDF
MITRE ATT&CKcon 2018: Summiting the Pyramid of Pain: Operationalizing ATT&CK,...
byMITRE - ATT&CKcon
 
PDF
Automation: The Wonderful Wizard of CTI (or is it?)
byMITRE ATT&CK
 
PDF
Cyber Threat hunting workshop
byArpan Raval
 
PDF
Building a Successful Internal Adversarial Simulation Team - Chris Gates & Ch...
byChris Gates
 
PDF
ATTACKers Think in Graphs: Building Graphs for Threat Intelligence
byMITRE - ATT&CKcon
 
PPTX
PowerShell for Practical Purple Teaming
byNikhil Mittal
 
ATT&CKcon Intro
byMITRE ATT&CK
 
The ATT&CK Philharmonic
byMITRE ATT&CK
 
Mapping ATT&CK Techniques to ENGAGE Activities
byMITRE ATT&CK
 
Threat Modelling - It's not just for developers
byMITRE ATT&CK
 
Mapping to MITRE ATT&CK: Enhancing Operations Through the Tracking of Interac...
byMITRE ATT&CK
 
Exploring how Students Map Social Engineering Techniques to the ATT&CK Framew...
byMITRE ATT&CK
 
Putting MITRE ATT&CK into Action with What You Have, Where You Are
byKatie Nickels
 
Tracking Noisy Behavior and Risk-Based Alerting with ATT&CK
byMITRE ATT&CK
 
MITRE ATT&CKcon 2.0: Using Threat Intelligence to Focus ATT&CK Activities; Da...
byMITRE - ATT&CKcon
 
ATT&CK Updates- ATT&CK's Open Source
byMITRE ATT&CK
 
ATT&CK Updates- ATT&CK for ICS
byMITRE ATT&CK
 
MITRE ATT&CKcon 2018: Hunters ATT&CKing with the Data, Roberto Rodriguez, Spe...
byMITRE - ATT&CKcon
 
Intelligence Failures of Lincolns Top Spies: What CTI Analysts Can Learn Fro...
byMITRE ATT&CK
 
ATT&CKING Containers in The Cloud
byMITRE ATT&CK
 
MITRE ATT&CKcon 2018: Summiting the Pyramid of Pain: Operationalizing ATT&CK,...
byMITRE - ATT&CKcon
 
Automation: The Wonderful Wizard of CTI (or is it?)
byMITRE ATT&CK
 
Cyber Threat hunting workshop
byArpan Raval
 
Building a Successful Internal Adversarial Simulation Team - Chris Gates & Ch...
byChris Gates
 
ATTACKers Think in Graphs: Building Graphs for Threat Intelligence
byMITRE - ATT&CKcon
 
PowerShell for Practical Purple Teaming
byNikhil Mittal
 

Similar to ATT&CK Metaverse - Exploring the Limitations of Applying ATT&CK

PDF
CISA usage of ATT&CK in Cybersecurity Advisories
byMITRE ATT&CK
 
PPTX
Leveraging MITRE ATT&CK - Speaking the Common Language
byErik Van Buggenhout
 
PDF
MITRE A-TAK Design Philosophy
bytom termini
 
PDF
This is why we don’t shout “Bingo”: Analyzing ATT&CK Integration in Endpoint ...
byMITRE ATT&CK
 
PDF
EU ATT&CK community ATT&CK-onomics
byGert-Jan Bruggink
 
PDF
MITRE ATT&CKcon 2.0: Keynote Address - The Friends We Made Along the Way; Ton...
byMITRE - ATT&CKcon
 
PDF
Mitre getting-started-with-attack-october-2019
byThang Nguyen
 
PDF
State of the ATT&CK 2024 - Adam Pennington
byMITRE ATT&CK
 
PPTX
Leverage Endpooint Visibilit with MITRE ATT&CK Framework
byDigit Oktavianto
 
PDF
Best practices fore MITRE EMERSON EDUARDO RODRIGUES
byEMERSON EDUARDO RODRIGUES
 
PDF
MITRE ATT&CKcon 2.0: attckr - A Toolkit for Analysis and Visualization of ATT...
byMITRE - ATT&CKcon
 
PDF
State of ATT&CK
byAdam Pennington
 
PDF
Sources of ATT&CK: A Bibliographic Journey through Enterprise ATT&CK - Robert...
byMITRE ATT&CK
 
PDF
Introduction to MITRE’s ATT&CK Framework.pdf
byseyohah504
 
PDF
RED-TEAM_Conclave
byNSConclave
 
PDF
ATT&CK’s Adoption in CTI: A Great Success (with Room to Grow!)
byMITRE ATT&CK
 
PDF
Mitre ATT&CK by Mattias Almeflo Nixu
byNixu Corporation
 
PPTX
ATTCKv11_for_RHISAC_may_2022
byTravis McWaters
 
PDF
CTI Workshop Full Slides Workshop Full Slides.pdf
byseyohah504
 
PPTX
Virtual Splunk User Group - Phantom Workbook Automation & Threat Hunting with...
byHarry McLaren
 
CISA usage of ATT&CK in Cybersecurity Advisories
byMITRE ATT&CK
 
Leveraging MITRE ATT&CK - Speaking the Common Language
byErik Van Buggenhout
 
MITRE A-TAK Design Philosophy
bytom termini
 
This is why we don’t shout “Bingo”: Analyzing ATT&CK Integration in Endpoint ...
byMITRE ATT&CK
 
EU ATT&CK community ATT&CK-onomics
byGert-Jan Bruggink
 
MITRE ATT&CKcon 2.0: Keynote Address - The Friends We Made Along the Way; Ton...
byMITRE - ATT&CKcon
 
Mitre getting-started-with-attack-october-2019
byThang Nguyen
 
State of the ATT&CK 2024 - Adam Pennington
byMITRE ATT&CK
 
Leverage Endpooint Visibilit with MITRE ATT&CK Framework
byDigit Oktavianto
 
Best practices fore MITRE EMERSON EDUARDO RODRIGUES
byEMERSON EDUARDO RODRIGUES
 
MITRE ATT&CKcon 2.0: attckr - A Toolkit for Analysis and Visualization of ATT...
byMITRE - ATT&CKcon
 
State of ATT&CK
byAdam Pennington
 
Sources of ATT&CK: A Bibliographic Journey through Enterprise ATT&CK - Robert...
byMITRE ATT&CK
 
Introduction to MITRE’s ATT&CK Framework.pdf
byseyohah504
 
RED-TEAM_Conclave
byNSConclave
 
ATT&CK’s Adoption in CTI: A Great Success (with Room to Grow!)
byMITRE ATT&CK
 
Mitre ATT&CK by Mattias Almeflo Nixu
byNixu Corporation
 
ATTCKv11_for_RHISAC_may_2022
byTravis McWaters
 
CTI Workshop Full Slides Workshop Full Slides.pdf
byseyohah504
 
Virtual Splunk User Group - Phantom Workbook Automation & Threat Hunting with...
byHarry McLaren
 

More from MITRE ATT&CK

PDF
Next-Gen Threat-Informed Defense: Human-Assisted Intelligent Agents - Rajesh ...
byMITRE ATT&CK
 
PDF
Birds of a Feather: The Evolution of Threat Actor Prioritization, Gap Analysi...
byMITRE ATT&CK
 
PDF
Using ATT&CK and MITRE CTID’s StP Frameworks to Assess Threat Detection Resil...
byMITRE ATT&CK
 
PDF
Bridging the Gap: Enhancing Detection Coverage with Atomic Red Team, Sigma, a...
byMITRE ATT&CK
 
PDF
SaaSy ATT&CK – Practical ATT&CK usage for SaaS-based Telemetry - Aaron Shelmire
byMITRE ATT&CK
 
PDF
I'll take ATT&CK techniques that can be done for $1000, Alex. - Ben Langrill
byMITRE ATT&CK
 
PDF
Practical Application of MITRE ATT&CK: Real World Usage in a Corporate Enviro...
byMITRE ATT&CK
 
PDF
Every Cloud Has a Purple Lining - Arun Seelagan
byMITRE ATT&CK
 
PDF
Confession: 3 Things I Wish I Knew About MITRE ATT&CK When I Was an FBI Profi...
byMITRE ATT&CK
 
PDF
ATT&CKcon 5.0 Keynote - From Ticket Closers to Practitioners- How Great Secu...
byMITRE ATT&CK
 
PDF
ATT&CKcon 5.0 Lightning Talks - Various Speakers
byMITRE ATT&CK
 
PDF
MITRE ATT&CK Updates: Defensive ATT&CK - Lex Crumpton
byMITRE ATT&CK
 
PDF
MITRE ATT&CK Updates: Enterprise - Casey Knerr
byMITRE ATT&CK
 
PDF
MITRE ATT&CK Updates: CTI - Path Forward - Joe Slowik
byMITRE ATT&CK
 
PDF
MITRE ATT&CK Updates: Software - Jared Ondricek
byMITRE ATT&CK
 
PDF
Updates from The Center for Threat Informed Defense - Jon Baker
byMITRE ATT&CK
 
PDF
Go Go Ransom Rangers: Diving into Akira’s Linux Variant with ATT&CK - Nicole ...
byMITRE ATT&CK
 
PDF
ATT&CK From Basic Principles - Tareq AlKhatib
byMITRE ATT&CK
 
PDF
Lifecycle-Aware Power Side-Channel Malware Detection - Alexander Cathis
byMITRE ATT&CK
 
PDF
From ATT&CK to CL&IM: Cyber Insurance Data Modeling using MITRE ATT&CK and be...
byMITRE ATT&CK
 
Next-Gen Threat-Informed Defense: Human-Assisted Intelligent Agents - Rajesh ...
byMITRE ATT&CK
 
Birds of a Feather: The Evolution of Threat Actor Prioritization, Gap Analysi...
byMITRE ATT&CK
 
Using ATT&CK and MITRE CTID’s StP Frameworks to Assess Threat Detection Resil...
byMITRE ATT&CK
 
Bridging the Gap: Enhancing Detection Coverage with Atomic Red Team, Sigma, a...
byMITRE ATT&CK
 
SaaSy ATT&CK – Practical ATT&CK usage for SaaS-based Telemetry - Aaron Shelmire
byMITRE ATT&CK
 
I'll take ATT&CK techniques that can be done for $1000, Alex. - Ben Langrill
byMITRE ATT&CK
 
Practical Application of MITRE ATT&CK: Real World Usage in a Corporate Enviro...
byMITRE ATT&CK
 
Every Cloud Has a Purple Lining - Arun Seelagan
byMITRE ATT&CK
 
Confession: 3 Things I Wish I Knew About MITRE ATT&CK When I Was an FBI Profi...
byMITRE ATT&CK
 
ATT&CKcon 5.0 Keynote - From Ticket Closers to Practitioners- How Great Secu...
byMITRE ATT&CK
 
ATT&CKcon 5.0 Lightning Talks - Various Speakers
byMITRE ATT&CK
 
MITRE ATT&CK Updates: Defensive ATT&CK - Lex Crumpton
byMITRE ATT&CK
 
MITRE ATT&CK Updates: Enterprise - Casey Knerr
byMITRE ATT&CK
 
MITRE ATT&CK Updates: CTI - Path Forward - Joe Slowik
byMITRE ATT&CK
 
MITRE ATT&CK Updates: Software - Jared Ondricek
byMITRE ATT&CK
 
Updates from The Center for Threat Informed Defense - Jon Baker
byMITRE ATT&CK
 
Go Go Ransom Rangers: Diving into Akira’s Linux Variant with ATT&CK - Nicole ...
byMITRE ATT&CK
 
ATT&CK From Basic Principles - Tareq AlKhatib
byMITRE ATT&CK
 
Lifecycle-Aware Power Side-Channel Malware Detection - Alexander Cathis
byMITRE ATT&CK
 
From ATT&CK to CL&IM: Cyber Insurance Data Modeling using MITRE ATT&CK and be...
byMITRE ATT&CK
 

Recently uploaded

PDF
Igniting the Future: Copilot trends, agentic transformation and product roadm...
byUni Systems S.M.S.A.
 
PDF
Vibe Coding vs. Spec-Driven Development [Free Meetup]
byHaim Michael
 
PDF
Incident Response Planning with a Foundation Model
byKim Hammar
 
PDF
Guided Substation Engineering with CoMPAS: Simplifying IEC 61850
byDanBrown980551
 
PDF
Unser Jahresrückblick – MarvelClient in 2025
bypanagenda
 
PDF
TPPmark2025 Kenta Inoue's answer 12/04/2025
byKenta Inoue
 
PDF
AI Technology important knowledge ......
byutkarshj2007
 
PPTX
Basics of Identity Access Management In mordern Infrastructure
byPrinceXavier18
 
PPTX
RISE with SAP for Automotive - S4 HANA Value.pptx
byAmira Jemi
 
PDF
TrustArc Webinar - Looking Ahead: The 2026 Privacy Landscape
byTrustArc
 
PDF
Digit Expo 2025 - EICC Edinburgh 27th November
byRay Bugg
 
PDF
Unlocking the Power of Salesforce Architecture: Frameworks for Effective Solu...
byvarsha30tiwari
 
PDF
Making Sense of Raster: From Bit Depth to Better Workflows
bySafe Software
 
PDF
Agentic Automation for Testers – A Hands-On Deep Dive
byUiPathCommunity
 
PDF
Accelerating Responsible AI Adoption in Public Sector and Private Organizations.
byYasir Naveed Riaz
 
PDF
Empowering Productivity with Clever Prompts and Intelligent Agents
byUni Systems S.M.S.A.
 
PPTX
Combining Induction and Transduction for Abstract Reasoning.pptx
byallen578468
 
PDF
Ransomware_Resilience_Strategic_Playbook.pdf
byAfonso Henrique Rodrigues Alves
 
PDF
DIGITAL FORENSICS - Notes for Everything.pdf
bypankajkumavatbeit
 
PDF
Greetings All Students Update 3 by Mia Corp
by©LDMMIA, ©Reiki Yoga
 
Igniting the Future: Copilot trends, agentic transformation and product roadm...
byUni Systems S.M.S.A.
 
Vibe Coding vs. Spec-Driven Development [Free Meetup]
byHaim Michael
 
Incident Response Planning with a Foundation Model
byKim Hammar
 
Guided Substation Engineering with CoMPAS: Simplifying IEC 61850
byDanBrown980551
 
Unser Jahresrückblick – MarvelClient in 2025
bypanagenda
 
TPPmark2025 Kenta Inoue's answer 12/04/2025
byKenta Inoue
 
AI Technology important knowledge ......
byutkarshj2007
 
Basics of Identity Access Management In mordern Infrastructure
byPrinceXavier18
 
RISE with SAP for Automotive - S4 HANA Value.pptx
byAmira Jemi
 
TrustArc Webinar - Looking Ahead: The 2026 Privacy Landscape
byTrustArc
 
Digit Expo 2025 - EICC Edinburgh 27th November
byRay Bugg
 
Unlocking the Power of Salesforce Architecture: Frameworks for Effective Solu...
byvarsha30tiwari
 
Making Sense of Raster: From Bit Depth to Better Workflows
bySafe Software
 
Agentic Automation for Testers – A Hands-On Deep Dive
byUiPathCommunity
 
Accelerating Responsible AI Adoption in Public Sector and Private Organizations.
byYasir Naveed Riaz
 
Empowering Productivity with Clever Prompts and Intelligent Agents
byUni Systems S.M.S.A.
 
Combining Induction and Transduction for Abstract Reasoning.pptx
byallen578468
 
Ransomware_Resilience_Strategic_Playbook.pdf
byAfonso Henrique Rodrigues Alves
 
DIGITAL FORENSICS - Notes for Everything.pdf
bypankajkumavatbeit
 
Greetings All Students Update 3 by Mia Corp
by©LDMMIA, ©Reiki Yoga
 
In this document
Powered by AI

Introduction to the presentation on ATT&CK in the metaverse, its limitations, and the speaker's background and goals.

Discussion on the growth of ATT&CK from 2015 to current, including the number of techniques and sub-techniques.

Insights on the adoption rates of the ATT&CK framework among different company sizes and sectors, and the need for detailed risk management.

Key use cases for utilizing the ATT&CK framework, including prioritization and operational context.

Strategies for teams to effectively use ATT&CK to convey security contexts and the importance of visual representation.

Challenges in local customization, maintaining relevance, addressing biases in understanding tactics, techniques, and procedures.

Techniques for building scenarios, validating techniques, and the importance of creativity in testing.

The role of the community in evolving ATT&CK, feedback processes, and prompts for organizations to evaluate their adoption.

Final thoughts on expanding the ATT&CK 'metaverse' and encouraging ongoing collaboration and improvement.

ATT&CK Metaverse - Exploring the Limitations of Applying ATT&CK