MITRE ATT&CK

MITRE ATT&CK is a publicly maintained knowledge base, run by the nonprofit MITRE Corporation, that catalogs the tactics and techniques real attackers use against computer systems, from gaining initial access to stealing data. Security teams use it as a common vocabulary for describing threats, testing defenses, and mapping security controls, and regulators and auditors increasingly ask companies to show how they cover it. For AI governance, it matters because it now includes entries for attacks on machine learning systems, which helps organizations assess risks like model theft, data poisoning, and manipulation of AI tools.

1 item

StandardsGlobal2026-10-19

MITRE ATT&CK v20 Names Prompt Injection and AI Agent Abuse as Formal Threat Categories

MITRE has released version 20 of its ATT&CK framework, adding formal entries for AI-specific attack techniques. New entries cover prompt injection against AI models, abuse of AI agents to steal data, and poisoning of web content to skew AI search results. Compliance and risk teams at organizations using AI agents or AI-assisted security tools now have a recognized threat taxonomy to map against their controls.

MITRE ATT&CK prompt injection AI agent abuse critical infrastructure threat taxonomy agentic AI red teaming