MITRE ATT&CK Tactics: The 14 Enterprise Tactics in Order

MITRE ATT&CK is a catalogue of how real attackers behave, built from observed intrusions rather than theory. It splits behaviour into two layers: tactics, the goal an adversary is pursuing at a given step, and techniques, the specific ways they achieve it. The Enterprise matrix has 14 tactics, and knowing them in order gives you a mental map of an intrusion from first look to final damage.

This is a one-line reference to those 14 tactics. Each has a stable ID (the TA00xx form), which is the reliable way to cite it, since technique and tactic names are occasionally revised while IDs are not. The order below is the standard left-to-right column order of the matrix, which roughly tracks how an intrusion unfolds.

The 14 Enterprise tactics

Tactic	ID	Attacker's goal	Example technique
Reconnaissance	TA0043	Gather information to plan the operation	Active Scanning (T1595)
Resource Development	TA0042	Build or acquire the infrastructure and tools	Acquire Infrastructure (T1583)
Initial Access	TA0001	Get a first foothold inside the environment	Phishing (T1566)
Execution	TA0002	Run attacker-controlled code on a host	Command and Scripting Interpreter (T1059)
Persistence	TA0003	Keep access across reboots and credential changes	Create Account (T1136)
Privilege Escalation	TA0004	Gain higher-level permissions	Exploitation for Privilege Escalation (T1068)
Defense Evasion	TA0005	Avoid being detected	System Binary Proxy Execution (T1218)
Credential Access	TA0006	Steal account names and passwords	OS Credential Dumping (T1003)
Discovery	TA0007	Learn the internal environment	System Information Discovery (T1082)
Lateral Movement	TA0008	Move from host to host	Remote Services (T1021)
Collection	TA0009	Gather the data of interest	Data from Local System (T1005)
Command and Control	TA0011	Communicate with compromised hosts	Application Layer Protocol (T1071)
Exfiltration	TA0010	Steal the collected data out of the network	Exfiltration Over C2 Channel (T1041)
Impact	TA0040	Manipulate, interrupt, or destroy	Data Encrypted for Impact (T1486)

The IDs are not sequential with the visual order, which is a common source of confusion. Reconnaissance and Resource Development were added to Enterprise later and kept high numbers (TA0043, TA0042), while the original matrix ran from Initial Access (TA0001) onward. Cite the ID and the ordering ambiguity disappears.

Reading the tactics as a lifecycle

The two leftmost tactics are pre-compromise. Reconnaissance and Resource Development largely happen on the attacker's own infrastructure and the open internet, so you rarely have telemetry for them. They matter for threat intelligence and attribution more than for endpoint detection.

From Initial Access onward you are usually inside your own visibility. This is the stretch where a strong logging posture pays off: a phishing email lands (Initial Access), a macro runs a script (Execution), a scheduled task is created (Persistence), a token is stolen (Privilege Escalation), and so on. The middle tactics are where most detections live.

Tactics, techniques, and coverage

A tactic answers why; a technique answers how. Defense Evasion (TA0005) is a goal that hundreds of techniques serve, from clearing logs to abusing signed binaries. When you build a detection, you are catching a technique, and mapping that detection back to its tactic shows you where your coverage is thick and where it is thin.

That mapping is the practical use of ATT&CK for a defender. Lay your detections over the matrix and you get a heatmap: strong on Execution and Persistence, perhaps blind on Credential Access or Lateral Movement. The gaps are your roadmap. This is also how threat-intel reports describe adversaries, by listing the techniques a group is known to use, which is why the framework doubles as a shared language between intel and detection teams.

Attacker techniques often reuse the same tooling across tactics. A signed Windows binary can serve Execution and Defense Evasion at once, which is why living-off-the-land activity shows up under multiple tactics in a single incident.

From tactics to named adversaries

Tactics describe behaviour in the abstract; groups make it concrete. MITRE tracks named adversary groups and the techniques each is observed using, which lets you go from a tactic on the matrix to the real actors that favour it. Our Threat Groups directory maps active groups to the ATT&CK techniques they are known for, so you can turn a coverage gap into a prioritised list: if the groups that target your sector lean on Credential Access, that column is where your next detection should go.

How to use this reference

1. Learn the 14 in order. The sequence is the spine of every ATT&CK discussion, and recognising a tactic name should be instant.
2. Cite the ID, not just the name. TA0006 is unambiguous where "Credential Access" can be paraphrased or revised.
3. Map your detections to tactics. Build the coverage heatmap and let the cold columns set your detection roadmap.
4. Treat the order as a map, not a timeline. Expect the middle tactics to repeat across hosts within one intrusion.
5. Connect tactics to techniques and groups. The intent lives in the tactic, the detail in the technique, and the real-world relevance in which groups use them against targets like yours.

Fourteen tactics is a small enough list to hold in your head and a rich enough one to structure an entire detection programme around. Learn them in order, anchor to the IDs, and ATT&CK becomes the common map your intel and defense both read from.

The 14 tactics one at a time

The one-line table is the quick reference. A sentence or two on each tactic makes the intent stick and shows where each sits in a real intrusion.

Reconnaissance (TA0043) covers gathering information to plan the operation. This is the attacker studying the target: scanning infrastructure, harvesting email addresses, reading job postings and public documents for names, technologies, and relationships. Most of it happens outside your network, so your visibility is limited to the edges where scanning and probing touch your systems.

Resource Development (TA0042) covers building or acquiring the tools and infrastructure for the operation. Registering domains, standing up servers, buying or developing malware, and setting up accounts all live here. Like reconnaissance, it happens on the attacker's side, and it matters more for intelligence and attribution than for endpoint detection.

Initial Access (TA0001) is the first foothold inside the environment. Phishing is the archetype, but this tactic also covers exploiting a public-facing application, abusing valid accounts, and compromising the supply chain. It is the seam between the pre-compromise tactics and everything you can actually see, which makes it a high-value place to invest in detection.

Execution (TA0002) is running attacker-controlled code on a host. Command interpreters, scripting engines, and scheduled tasks all serve it. Almost every intrusion passes through execution repeatedly, so it is one of the densest tactics for detection opportunities.

Persistence (TA0003) keeps access across reboots, logouts, and credential changes. Creating accounts, adding scheduled tasks or services, and planting startup entries are common. Persistence is where an attacker converts a fragile foothold into durable presence, and its artifacts often outlive the initial intrusion.

Privilege Escalation (TA0004) is gaining higher permissions than the initial access granted. It ranges from exploiting a vulnerability to abusing a misconfiguration or a token. It frequently overlaps with persistence and defense evasion, since higher privileges make both easier.

Defense Evasion (TA0005) is avoiding detection. It is the largest tactic by technique count, spanning everything from clearing logs and disabling security tools to abusing signed binaries and obfuscating files. Because so many techniques serve it, it is a tactic where coverage gaps are easy to accumulate without noticing.

Credential Access (TA0006) is stealing account names and passwords. Dumping credentials from memory, capturing input, and abusing stored secrets all live here. It is the tactic that turns a single compromised host into a route across the whole environment, which is why it deserves heavy investment.

Discovery (TA0007) is learning the internal environment. Enumerating accounts, systems, shares, and security tooling gives the attacker the map they need to move. Discovery activity is often noisy and repetitive, which makes it a productive place to hunt.

Lateral Movement (TA0008) is moving from host to host inside the network. Remote services, remote management tooling, and stolen credentials carry the attacker across the estate. It is where a contained incident becomes an enterprise one, so detections here have outsized value.

Collection (TA0009) is gathering the data of interest before it leaves. Staging files, capturing screens, and pulling data from local systems and shares are typical. Collection immediately precedes exfiltration and often shares its telemetry.

Command and Control (TA0011) is communicating with compromised hosts. The attacker's tooling calls out to infrastructure they control, frequently disguised as ordinary web traffic. Network telemetry is the primary lens on this tactic.

Exfiltration (TA0010) is stealing the collected data out of the network. It may ride the command-and-control channel or use a separate route such as a cloud storage service. Volume and destination anomalies are the classic signals.

Impact (TA0040) is manipulating, interrupting, or destroying systems and data. Ransomware encryption, data wiping, and service disruption all sit here. It is usually the final act, the point where the intrusion stops being covert and announces itself.

A short worked walkthrough

Stringing a few tactics together shows why the order is a map rather than a script. An intrusion might open with a phishing email that a user opens, which is Initial Access. The attachment runs a script, which is Execution. The script creates a scheduled task so it survives a reboot, which is Persistence. So far the path reads left to right across the matrix.

Then the loop begins. From that foothold the attacker enumerates the host and the network, which is Discovery. They dump credentials from memory, which is Credential Access. Those credentials let them authenticate to another machine, which is Lateral Movement. On the new machine they run more code, which is Execution again, and enumerate again, which is Discovery again. The same four or five tactics repeat on each host as the attacker expands.

Only once they reach systems holding the data they want do the later tactics engage: staging the data is Collection, sending it out is Exfiltration, and encrypting what remains is Impact. Laid over the matrix, the intrusion does not travel through fourteen columns once. It sprints through the first few, spends most of its time cycling through a cluster in the middle across many hosts, and touches the last few only at the end. That shape is why experienced defenders treat the middle tactics as the heart of a detection programme.

Tactics compared to related models

ATT&CK tactics are one way to structure attacker behaviour, and it helps to place them next to the other models teams use.

Model	What it describes	Granularity	Best used for
ATT&CK tactics	Adversary objectives across an intrusion	14 goals	Coverage mapping and shared vocabulary
ATT&CK techniques	Specific ways objectives are achieved	Hundreds of Txxxx entries	Building and tagging detections
Cyber Kill Chain	High-level stages of an attack	7 sequential phases	Executive-level narrative
Diamond Model	Adversary, capability, infrastructure, victim	4 linked features	Intrusion analysis and attribution

The Cyber Kill Chain is older and more linear, and it works well for explaining an attack at a high level to a non-technical audience. The Diamond Model is analytic, focused on the relationships between an adversary, their tooling, their infrastructure, and their victims, which makes it strong for attribution work. ATT&CK sits between them in granularity and is the most directly useful for detection engineering, because its techniques are concrete enough to write detections against while its tactics give those detections a shared frame. Most mature teams use ATT&CK as the backbone and reach for the kill chain or the Diamond Model when the audience or the analytic task calls for it.

Common misconceptions

A few misreadings of the matrix are worth clearing up.

The first is that the tactics are a fixed sequence. The left-to-right order is a rough narrative of how intrusions tend to unfold, and real incidents loop, skip, and revisit tactics constantly. Treating the order as a strict timeline leads to detection strategies that assume attackers march in step, which they do not.

The second is that more technique coverage is automatically better. A coverage heatmap is a planning tool, and covering a technique with a weak, noisy, or easily evaded detection is not the same as covering it well. Depth and reliability on the techniques that matter for your threat model beat a thin layer spread across every cell.

The third is confusing tactics with techniques. A tactic is the goal, and a technique is the method. Defense Evasion is a tactic, and abusing a signed binary to evade detection is a technique that serves it. Citing a tactic when you mean a technique, or the reverse, muddies reports and detection mappings.

The fourth is assuming ATT&CK is exhaustive or predictive. It is descriptive, built from observed behaviour, so it captures what has been seen rather than everything that is possible. New techniques are added as they are observed. It is a living catalogue of the known, and a gap in the matrix is not a guarantee that a behaviour cannot happen.

How ATT&CK evolved

ATT&CK began as an internal effort to document real adversary behaviour in a structured way, and it grew into a public knowledge base that is now a common language across the security industry. Over time the model expanded from its original enterprise focus into additional matrices for mobile and for industrial control systems, and the enterprise matrix itself gained the two pre-compromise tactics, Reconnaissance and Resource Development, which is why their IDs sit high even though they appear first in the visual order.

The framework is revised on a regular cadence as new behaviours are observed and as the community contributes. Techniques are added, split into sub-techniques, merged, or deprecated, and names are occasionally revised. This is exactly why the stable IDs matter: a report that cites TA0006 or a technique's Txxxx identifier stays unambiguous across revisions, where a name written out in prose can quietly fall out of date. For a defender, the practical stance is to treat ATT&CK as a current reference to check against rather than a fixed document to memorise once.

Turning the matrix into a detection roadmap

The single most practical use of the 14 tactics is as the top-level structure of a coverage program. The method is straightforward and repeatable. Start by mapping every detection you already run to the tactic and technique it catches. This produces the heatmap: columns that glow because many reliable detections cover them, and columns that stay dark because nothing does.

Read the dark columns against your threat model rather than against a wish to cover everything evenly. If the adversaries most likely to target your sector lean heavily on Credential Access and Lateral Movement, a gap in those columns is urgent, while a gap in a tactic those groups rarely use can wait. This is where tactics connect to named adversaries: the matrix tells you what is possible, and the groups that actually operate against organisations like yours tell you what is probable. Prioritising the intersection turns an abstract heatmap into a ranked list of detections to build next.

Then close the gaps deliberately, one technique at a time, and re-map as you go so the heatmap stays current. Over successive cycles the cold columns warm, the coverage becomes both broad and deep on the tactics that matter, and the program has a defensible, visible rationale for every detection it invests in. The 14 tactics give that whole effort its spine, because they are few enough to reason about at a glance and structured enough to organise hundreds of individual detections beneath.

A final habit keeps the roadmap honest: revisit it after every significant incident. An intrusion that slipped through reveals exactly which tactic your coverage was thin on in the real world, where a paper heatmap can look deceptively complete. Feeding that lesson back into the map is how the matrix earns its place as a living plan that keeps pace with how attackers actually operate.

Frequently asked questions

What is the difference between a tactic and a technique? A tactic is the attacker's objective at a step, such as Persistence or Exfiltration. A technique is a specific way of achieving that objective. Each tactic contains many techniques, and a single technique can sometimes serve more than one tactic.

Why are the tactic IDs out of order? Reconnaissance and Resource Development were added to the enterprise matrix after the original tactics, so they carry high IDs (TA0043 and TA0042) despite appearing first in the left-to-right order. Citing the ID rather than relying on visual position avoids the confusion.

Do attackers always follow the tactics in order? No. The order is a rough narrative, and real intrusions loop through the middle tactics repeatedly across many hosts. Treat the sequence as a map of possible moves rather than a fixed timeline.

How many techniques are there? The enterprise matrix holds hundreds of techniques and sub-techniques spread across the 14 tactics, and the count changes as MITRE revises the framework. The tactics stay at 14 while the techniques beneath them grow and shift.

How do defenders use the tactics? Mainly for coverage mapping and shared language. Laying detections over the matrix produces a heatmap of strong and weak areas, and the cold columns become a detection roadmap. Threat-intel reports use the same tactics and techniques to describe adversary behaviour, so the framework connects intel and detection teams.

What is the difference between ATT&CK and the Cyber Kill Chain? The Cyber Kill Chain is a high-level, mostly linear model of seven attack stages, good for explaining an attack narrative. ATT&CK is more granular and non-linear, with concrete techniques you can write detections against, which makes it the more practical tool for detection engineering.

Should I cite the tactic name or the ID? Cite the ID for precision, and use the name for readability. The stable TA00xx identifiers do not change when MITRE revises names, so pairing the two gives you both clarity and durability.

Are there matrices other than Enterprise? Yes. Alongside the Enterprise matrix covered here, MITRE maintains separate matrices for mobile platforms and for industrial control systems, each with its own tactics tuned to that environment. The Enterprise matrix and its 14 tactics are the most widely referenced, and the same tactic-and-technique structure carries across all of them.

Related guides

• MITRE ATT&CK Framework Explained
• MITRE ATT&CK for Defenders
• Cyber Kill Chain Explained
• LOLBins Explained
• Lateral Movement Explained