Which one should you choose for a security test?
Choose MITRE ATT&CK when you need technique-level planning, detection mapping and reporting, and choose the Cyber Kill Chain when executives need a high-level, ordered narrative of how an intrusion would unfold. For most adversary-based engagements, use both: the kill chain frames the story and the phases, while ATT&CK supplies the specific techniques the testers will emulate and the detections your team should be able to confirm. ATT&CK matters most when the blue team must prove coverage, since each technique can be traced to a control or alert. The kill chain matters most when the audience is a board or risk committee that needs the attack sequence explained without a matrix.
Neither framework is a testing methodology on its own. ATT&CK is a knowledge base of adversary behavior and does not tell you how to scope, authorize, execute or report a test, and the kill chain is a model of what an adversary must complete, not a set of steps for testers. Pair either one with a process such as NIST SP 800-115 or PTES, which covers rules of engagement and reporting. Before you commission the work, ask the provider which ATT&CK version and which matrix they will use, and confirm whether the emulation plan maps each technique to a specific test case and a detection owner.
If your regulator requires threat-led testing, check whether its scheme names a specific framework or leaves the choice to the provider. The TIBER-EU framework, for example, expects scenarios to be planned across the in, through and out phases of an attack, which aligns naturally with the kill chain's ordered view, while the technique-level detail still has to come from a catalog such as ATT&CK. Agree in the statement of work how the two will be cross-referenced, and who keeps that mapping current when ATT&CK releases a new version.
How the two models differ in detail, ordering and planning use
This table compares MITRE ATT&CK and the Cyber Kill Chain on how each is structured, what it is built from, and how red teams, detection engineers and report writers use it. Read each row as a question to answer about your own program, since the models are designed for different jobs. The main takeaway is that the kill chain frames the intrusion as a sequence, while ATT&CK supplies the specific techniques to test and map against.
| Dimension | MITRE ATT&CK | Cyber Kill Chain |
|---|---|---|
| Level of detail | Lower level of definition, describing specific adversary techniques and behaviors | High-level model of what an adversary must complete to reach an objective |
| Ordering | Tactics are unordered and may not all occur in a single intrusion | Seven ordered steps, presented as a sequence of phases |
| Granularity | Many techniques grouped under tactics, suited to choosing specific actions to emulate | Seven phases, suited to describing the overall campaign arc |
| Data source | Built mainly from publicly available threat intelligence and incident reporting | Lockheed Martin's Intelligence Driven Defense model, with the steps defined by the vendor |
| Red team planning | Used to pick specific techniques for an emulation plan, with 15 Enterprise tactics in v20 | Used to frame the attack path and the stages a test should reach, such as in, through and out phases in TIBER-EU |
| Detection coverage mapping | Detections are typically mapped to individual techniques, so you can see which ones have coverage | Detections are typically mapped to phases, which shows where in the chain you can interrupt activity |
| Reporting | Findings can cite specific technique IDs, which supports precise detection gap discussions | Findings can describe which phase a test reached and where the chain was broken |
| Cost of learning | Larger vocabulary to learn, and a matrix to maintain as versions change (confirm the version your team cites) | Smaller set of seven steps, quicker to brief to executives, but less precise for tooling |
When ATT&CK, the Kill Chain or both fit your test
For a board or executive audience, the Cyber Kill Chain usually leads. Its seven ordered steps tell a sequence from early reconnaissance to actions on objectives, and leaders can follow that story without learning technique names. Lockheed Martin presents the model as part of its Intelligence Driven Defense approach, framed around what an adversary must complete to reach an objective. ATT&CK tactics are unordered and may not all occur in one intrusion, so they are harder to narrate on a single slide.
- Narrative order: seven ordered phases give executives a sequence they can question and remember.
- Investment decisions: asking which phase a control stops an intruder in links directly to budget choices.
- When ATT&CK adds value: if a board member asks which specific behaviors the program covers, a technique-level answer is needed, so add ATT&CK as an appendix.
- Coverage claims: kill chain phases are high level, so do not present them alone as proof that detection coverage exists.
Before the briefing, confirm whether executives will later review detection metrics, because that determines how much technique detail the briefing should carry.
For red team engagement planning, MITRE ATT&CK usually leads. Its tactics work as a catalog from which planners select specific techniques for each stage of an adversary emulation plan. The ATT&CK version history records v20, released on 13 October 2026, which lists 15 Enterprise tactics used to plan adversary emulation. The Cyber Kill Chain adds value when the team needs an ordered attack story, which helps design the narrative of entry, foothold and objective.
- Technique selection: ATT&CK lets planners choose named techniques under each tactic and record them for the engagement.
- Scenario sequencing: an ordered view helps build a coherent intrusion path, and TIBER-EU plans schedule each scenario into in, through and out phases.
- Scope control: NIST SP 800-115 provides a rules of engagement template, and planned techniques should be checked against what the rules allow.
- Unordered risk: because ATT&CK tactics may not all occur in one intrusion, a plan built only from the matrix can become an incoherent chain, so sequence it on purpose.
Before signing a statement of work, ask the provider which ATT&CK version they map to and whether the rules of engagement list specific techniques or only broad categories.
For detection engineering and SOC validation, MITRE ATT&CK leads. Detection rules and test steps need a common technique identifier so that gaps can be counted and tracked. CIS Safeguard 18.4 asks that security measures be validated after each test so that detections cover the techniques the testers used, and technique-level tagging is the practical way to meet that expectation. The Cyber Kill Chain adds value when leadership wants a rolled-up view of which phases of an intrusion the program can see.
- Coverage mapping: tag each detection rule and each test step with an ATT&CK technique so gaps are visible.
- Granularity: a kill chain phase is too coarse to show that one specific persistence method goes unmonitored.
- Phase summary: roll technique results up to kill chain phases for management reporting.
- Version drift: ATT&CK changes between versions, so record the version used in every mapping and in every test report.
Ask whether the test provider can deliver technique-level results in a format your detection team can import, and confirm that your SIEM stores technique tags on rules and alerts.
In regulated threat-led testing, the scheme or regulator sets the structure, so the scheme's own rules come first. TIBER-EU runs threat intelligence-based red team tests through preparation, testing and closure, with at least 12 weeks of active testing and mandatory purple teaming, and the ECB states these tests produce no pass or fail result. Under DORA Article 26, threat-led penetration testing is required at least every 3 years for entities identified by their competent authority. ATT&CK typically supplies the shared technique vocabulary inside that structure, while the kill chain's entry-to-objective flow resembles the in, through and out phases TIBER-EU plans use.
- Scheme rules first: the scheme defines phases, minimum durations and the purple teaming step.
- Threat intelligence input: threat intelligence reports are commonly mapped to ATT&CK, but confirm what your scheme expects.
- Scenario phases: TIBER-EU's in, through and out phases correspond to the kill chain's progression toward an objective.
- Findings without a score: results describe what happened, so map them to techniques to guide remediation.
Confirm the required model and deliverables with your regulator or the scheme's accreditation body. For CBEST, the Bank of England names CREST as the accreditation and certification body.
What each model helps a test find and what it misses
ATT&CK and the Cyber Kill Chain answer different planning questions, so each one surfaces different findings. The cards below show where each model guides a test well, where it goes quiet, and what the tester has to add from other sources to close the gap.
Technique-level coverage
ATT&CK breaks adversary behavior into tactics and techniques that map directly to detection rules and emulation steps. A test built on it can show which specific techniques were attempted and which were logged. The gap is that a long technique list does not tell you which techniques a given adversary favors. Check whether your threat intelligence source names the actor and whether the emulation plan is limited to techniques that actor is known to use.
Narrative attack paths
The Cyber Kill Chain's seven ordered steps describe how an intrusion has to progress from reconnaissance to actions on objectives. That order helps a team decide where to place controls and where a test should stop an attempt. It misses lateral branches, parallel paths and techniques that do not fit a linear sequence. Testers should map each engagement's scenario to the ordered steps and also record off-sequence moves that the sequence does not predict.
Detection gaps
Mapping test results to ATT&CK techniques shows which behaviors the monitoring stack saw and which it missed. CIS Safeguard 18.4 asks for security measures to be validated after each test so that detections cover the techniques the testers used. The kill chain can show that a phase was blocked, but it rarely shows which telemetry source should have fired. Ask the team to record, for each technique, the log source, the alert and the response time.
ICS coverage through ATT&CK for ICS
The ATT&CK for ICS matrix covers operational technology with 12 tactics, from Initial Access through Inhibit Response Function and Impair Process Control to Impact. Neither the Enterprise matrix nor the seven-step kill chain was written with process control in mind, so an OT test that relies on either one can miss attacks against controllers and safety functions. Confirm with plant engineers which safety functions are in scope before choosing the matrix and the emulation steps.
AI system coverage through ATLAS
MITRE ATLAS catalogs adversary tactics and techniques aimed at AI systems, and its v2026.09 data release lists 16 tactics and 120 techniques. Neither ATT&CK nor the kill chain was written for prompt injection, model extraction or poisoned training data, so an AI red team that uses only those models will miss them. Ask whether the scope includes the model, the retrieval pipeline and any tool-calling agent, and map each of those to ATLAS entries.
Vulnerabilities outside adversary behavior
Both models describe what an adversary does with a weakness, not the weakness itself. Misconfigurations, unpatched components, weak cryptography and insecure code can exist without any matching technique in the matrix, so a test organized around ATT&CK can report a clean result while the system is still exposed. NIST SP 800-115 treats vulnerability analysis and application security testing as separate work from scenario testing. Pair the adversary-focused plan with a scan, a code review or an application test that covers the asset inventory.
What you receive when a test is planned against each model
This table compares the artifacts a provider typically produces when a test is planned around ATT&CK technique mapping versus the Cyber Kill Chain's ordered phases. Read the provider-dependent rows as items to confirm in the statement of work, since neither framework prescribes a deliverable format.
| Deliverable | MITRE ATT&CK planning | Cyber Kill Chain planning |
|---|---|---|
| Engagement plan | Lists tactics and techniques selected for emulation, with the adversary profile behind them | Organized around the seven ordered steps, with objectives mapped to each phase |
| Technique mapping | Each action tagged to an ATT&CK technique ID, so results can be compared across tests | Usually mapped to phases rather than individual techniques, so less granular unless the provider adds a technique layer |
| Kill chain narrative | Often reconstructed as a sequence after the fact, since ATT&CK tactics are unordered | Core output: a phase-by-phase story of how the simulated intrusion progressed or was stopped |
| Detection coverage matrix | Strongest fit: techniques tested versus techniques detected, per data source | Coarser view of which phases were detected or blocked, useful for executive reporting |
| Findings tied to tactics or phases | Each finding linked to a tactic and technique, with the detection gap stated | Each finding linked to the phase where the adversary was stopped or missed |
| Executive summary | Often focuses on coverage percentages only if the provider defines and states the method | Usually focuses on how far the simulated adversary reached and which phase controls held |
| Provider-dependent artifacts | Technique-level evidence, ATT&CK Navigator layers and data source mapping: confirm they are in scope | Phase timelines and narrative depth: confirm the level of detail and who reviews the draft |
How compliance frameworks reference adversary testing
Compliance frameworks reward validation of detections more than they name a particular adversary model. CIS Controls v8.1 Safeguard 18.4 asks that security measures be validated after each test so that detections cover the techniques the testers used. That wording is where ATT&CK's technique-level detail becomes useful in practice: after a penetration test or red team exercise, you need to show which techniques were exercised and which detections fired. A practical check is to ask your testers to record each action against a technique identifier, then compare that list with your detection rules and alert logs. The Kill Chain phase labels can help summarize the story for executives, but the evidence trail is usually built at the technique level.
DORA sets a time-based expectation. Article 26 requires threat-led penetration testing at least every 3 years for entities that their competent authority identifies, and Article 25(1) lists the test types that the testing programme may include, such as vulnerability assessments, scenario-based tests and penetration testing. TIBER-EU, published by the ECB in January 2025, runs in preparation, testing and closure phases. Its test plans schedule each scenario at least into the in, through and out phases of an attack, which maps naturally onto the Kill Chain's ordered view of intrusion. Confirm with your regulator whether they expect TIBER-EU or a comparable scheme, and which scenario structure they accept.
Neither ATT&CK nor the Cyber Kill Chain is named as a mandatory method in these sources. DORA, TIBER-EU, CIS Controls and PCI SSC guidance describe outcomes, test types and evidence, not a required taxonomy. Before you commit to a mapping format for an assessment, ask your regulator, auditor or assessor which model they will accept as the basis for reporting, and whether they want a specific ATT&CK version or only a consistent reference. Record that answer in the statement of work so the testing firm reports in the format your assessor will read.
What drives the cost and effort of each approach
Cost and effort in an ATT&CK or kill chain exercise come from a small set of components, and each one is paid to a different party. Use these cards to see which components your team will fund internally and which you should request as line items in a written quote.
Depth of technique mapping
Mapping detections to ATT&CK techniques means a tester or analyst reviews each technique, decides which sub-techniques apply to your environment, and records the evidence. This work is usually billed as analyst time and grows with the number of techniques in scope, not with the number of tactics. Ask the provider whether the quote covers technique-level mapping or only tactic-level coverage, and who owns the resulting matrix after the engagement.
Size of the detection estate
Validating detections means replaying or emulating techniques against every log source, sensor and rule that should fire. A large estate with many sensors, tenants and business units multiplies test setup, log collection and triage. Ask who provisions test endpoints and accounts, whether the team needs access to your SIEM during the exercise, and whether retesting is included when rules change.
Scenarios and kill chain phases
A kill chain exercise is organized around ordered phases, so the number of scenarios and the phases each one covers set the test count. Illustrative example: a scenario that runs from initial access through actions on objectives needs evidence at every phase, while a single-phase test needs far less. Request the scenario list, the phases covered by each scenario, and the number of reruns included.
Threat intelligence input
Choosing techniques that match a real adversary requires current threat intelligence about actors who target your sector. Some providers include this in the engagement, while others expect your team or a separate intelligence vendor to supply it. Clarify who selects the adversary profile, which sources are used, and whether the intelligence is refreshed before the test starts.
Purple teaming effort
Purple teaming pairs testers with defenders to tune detections during the exercise, which adds working sessions and shared review time. This effort recurs when each finding leads to a rule change and a retest. Ask whether purple sessions are a fixed number of hours, how many retests are included, and which party writes and deploys the detection changes.
Reporting detail
The report determines how much follow-up work your team inherits. A technique-level report with evidence, detection status and recommended rules takes more writing time than a summary of findings, and it can be reused as a coverage baseline. Request the report format, whether it maps each step to ATT&CK technique IDs and phases, whether raw evidence is delivered, and whether a debrief is included.
How to run a combined ATT&CK and kill chain engagement
This sequence turns a kill chain narrative into a set of ATT&CK techniques that testers execute and defenders check, so the final record shows which adversary behaviors were detected and which were missed. It keeps the phases ordered while letting the technique catalog provide detail.
Set objectives and rules of engagement
The buyer and the testing provider agree on the business objective, the systems in scope, out-of-scope assets, permitted techniques, testing windows, emergency contacts and stop conditions. NIST SP 800-115 provides a rules of engagement template in Appendix B that you can adapt for this purpose. Ask the provider to confirm which intrusion phases may touch production and which must stay in a staging or lab environment. The step is complete when the signed rules of engagement name a single accountable contact on each side and list every permitted action.
Select the kill chain scenario
Choose the intrusion narrative the exercise will test, such as a phishing-led intrusion aimed at a specific data store or an external foothold followed by lateral movement. Lockheed Martin's Cyber Kill Chain provides seven ordered phases to frame that story at a high level. The buyer should supply the threat assumptions, which may come from internal incident history or threat intelligence, and confirm that the chosen scenario reflects a realistic adversary for its sector. The step is complete when the scenario is written as a short ordered narrative with a stated end objective.
Map each phase to ATT&CK techniques
The testing lead breaks each kill chain phase into candidate ATT&CK techniques, using the Enterprise matrix and, where operational technology is in scope, the ICS matrix. Because ATT&CK tactics are unordered and do not all occur in one intrusion, the mapping should select only the techniques the scenario needs. The buyer should review the list against its environment and remove techniques that do not apply. The step is complete when every phase has a named set of technique IDs and each technique has a target system and an owner.
Agree detection validation criteria
For each mapped technique, the buyer's security operations team and the provider agree what counts as a detection, such as an alert in the SIEM, a host sensor event, or an analyst ticket, and what the expected response is. CIS Safeguard 18.4 asks organizations to validate security measures after testing so detections cover the techniques testers used, so this criteria list is the baseline for that check. Confirm which log sources and alert rules are expected to fire and who records the result. The step is complete when each technique has a written detection criterion, a data source and a named reviewer.
Brief the detection team without disclosing the plan
Decide how much of the plan the defenders will see before execution. A full white-team setup gives the defenders the schedule and technique list, while a covert setup keeps the operational detail with a small control group. The buyer chooses the model and records the choice in the rules of engagement. The provider confirms how deconfliction works if a live response starts during the exercise. The step is complete when the control group knows how to halt activity and the choice of disclosure level is documented.
Execute the phases in kill chain order
The provider runs the scenario phase by phase, recording the timestamp, technique ID, target and tool used for each action. Testers should log each technique as attempted, successful or blocked, because a failed attempt is still evidence about detection and prevention. The buyer's monitoring team logs what it observes independently. The step is complete when each mapped technique has an execution record and any stop events are documented with the reason.
Compare execution logs with detection records
After execution, the two sets of records are matched technique by technique. Each technique is classified as detected, detected late, blocked, or not detected, based on the criteria agreed earlier. Gaps are recorded with the affected data source, the missing rule or the failed correlation. The buyer should ask the provider to show the raw logs behind each classification so the result can be checked. The step is complete when every technique has one classification and a supporting log reference.
Record detected and missed techniques in the report
The final report lists the techniques that were detected, the ones that were not, and the remediation owners for each gap. Organize the findings by kill chain phase and by ATT&CK technique ID so that the detection engineering team can map them to rules. The buyer should confirm the report format before the engagement starts and agree how gap items feed into the next validation cycle. The step is complete when the report is accepted, every missed technique has an owner, and the retest date is agreed in writing.
What buyers ask before choosing ATT&CK or the Kill Chain
Does MITRE ATT&CK replace the Cyber Kill Chain for red team planning?
No. The two models work at different levels, so one does not replace the other. The ATT&CK FAQ places ATT&CK at a lower level of definition than the Kill Chain, and it describes ATT&CK tactics as unordered, noting they may not all occur in a single intrusion. Lockheed Martin's Cyber Kill Chain has seven steps, presented in order, that describe what an adversary must complete to reach its objective. Teams often use the Kill Chain to explain the intrusion story to executives and ATT&CK to name the specific techniques they need to detect. Before writing a statement of work, decide whether the test must answer a narrative question, a coverage question, or both.
How much effort does mapping test results to ATT&CK take?
The effort is driven by the number of findings, the number of techniques in scope, the quality of your log sources, and whether your team already tags alerts with technique identifiers. ATT&CK v20, released on 13 October 2026, lists 15 Enterprise tactics, so the matrix you choose (Enterprise, ICS or both) sets the size of the mapping work before any testing begins. Ask the provider how each technique is validated, who reviews the mapping, whether the output is a spreadsheet or a machine-readable file, and how the mapping is updated when ATT&CK releases a new version. Mapping is recurring work, not a one-time task, because the matrix changes between releases.
How long does a combined ATT&CK and Kill Chain engagement run?
No fixed duration applies to every engagement, and the answer depends on scope, the number of scenarios and the amount of purple teaming you require. The TIBER-EU framework, dated January 2025, requires at least 12 weeks of active testing for threat-led red team tests and plans each scenario through in, through and out phases of an attack. That timeline belongs to a regulator-run scheme and is not a general benchmark for an ATT&CK-mapped exercise. For a non-regulated engagement, ask for a written schedule with milestones covering planning, rules of engagement, testing, detection review and reporting, and confirm which phases are included in the fixed scope.
What must our team provide before a red team exercise starts?
Your team must provide the rules of engagement, the list of systems and networks in scope, the emergency stop criteria, and named contacts who can halt the test. NIST SP 800-115 includes a rules of engagement template in Appendix B, which is a practical starting point for these terms. You should also decide whether the blue team is informed in advance or tested blind, because that choice changes what detections you can measure. For an ATT&CK-based exercise, provide access to the relevant logs, your current detection content, and the threat intelligence priorities you want the scenarios to reflect. Confirm each item in writing before the fixed-scope work begins.
Can our internal team run an ATT&CK-based exercise without outside help?
It can, for a limited scope, if the team has people who understand ATT&CK, can read and correlate logs, and can write or tune detection rules. The harder part is objectivity and breadth: internal staff usually know the environment well enough to avoid some attack paths, and they may lack time or independence when they must report weaknesses in their own controls. CREST accredits member companies and certifies individuals in disciplines including security testing and red teaming, so ask whether the people you hire or the firm you use hold relevant credentials. Confirm the certification status with the issuing body, and do not rely on a vendor's description alone.
Which model should go into our statement of work?
Name the model that answers your primary question, then state the other as a secondary reference. If the main goal is to test whether detections cover the behaviors adversaries use, reference ATT&CK by tactic and technique, and require a technique-level mapping of results. If the goal is a narrative of how an intrusion progressed to its objective, reference the Kill Chain's seven steps. CIS Safeguard 18.4 asks organizations to validate security measures after each test so that detections cover the techniques the testers used, which supports requiring a technique-level output. Specify the matrix version, the output format, and who approves the final mapping.
Do we need the ATT&CK for ICS matrix if our scope includes operational technology?
Yes, if operational technology is in scope, because the Enterprise matrix does not describe industrial control system behavior. The ATT&CK for ICS matrix has 12 tactics, running from Initial Access through Inhibit Response Function and Impair Process Control to Impact. Those tactics describe adversary goals that matter for physical processes, such as disrupting or manipulating control functions. Before planning an OT exercise, confirm with your operations staff which systems can be tested safely, which tests must be passive, and whether the Kill Chain or the ICS matrix best fits the scenarios your safety and operations teams have approved.
Does using either model satisfy DORA or CBEST testing requirements?
Neither model satisfies a regulatory requirement by itself. DORA Article 25(1) lists test types such as vulnerability assessments, scenario-based tests and penetration testing, and Article 26 requires threat-led penetration testing at least every 3 years for entities their competent authority identifies. TIBER-EU tests produce no pass or fail result, and the Bank of England names CREST as the accreditation and certification body for CBEST. ATT&CK and the Kill Chain can structure the scenarios and reporting inside those schemes, but the regulator, the framework and the approved provider set the requirements. Confirm with your supervisor which scheme applies before you choose a model.
How DeployOpen scopes and delivers adversary-based testing
DeployOpen is a Chainscore Labs company that runs security testing, including red teaming, and prepares the systems and evidence that compliance assessors review. If you are considering an adversary-based engagement built around ATT&CK technique selection or a kill chain walkthrough, the practical question is how the work is scoped, not which framework label appears in the report. DeployOpen does not issue audit reports, attestations or certifications. Independent auditors and certification bodies do that work, so an engagement should be scoped with your assessor in mind from the start. Most DeployOpen engagements are fixed-scope. Before work starts, the written scope should state which adversary model drives the exercise, which phases are in play (for example, initial access through actions on objectives), which techniques or tactics are targeted, which environments and accounts are in bounds, and what the deliverables and timelines are. Ask that the scope name the rules of engagement, the escalation contacts, and whether detection outcomes will be mapped to ATT&CK technique IDs, to kill chain phases, or to both. A quote follows from that written scope, so changes to the adversary model or the number of target environments will change the quote.
For continuous work, DeployOpen offers retainers covering ongoing testing and support. A retainer suits a team that wants to repeat adversary emulation after detection changes, platform upgrades or new cloud accounts, rather than treating each exercise as a one-off. Confirm in the retainer terms how re-testing is counted, how new technique coverage is added, and how evidence from each cycle is retained for your assessor. Ask DeployOpen to state these terms in writing before you commit.
