Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

sophos

ATT&CK grew a 15th tactic: A practical DFIR field guide to the Stealth / Defense Impairment split

Sep 14, 2026 By Marchelle David In Sophos
Artifacts and tooling for the new Enterprise MITRE ATT&CK matrix tactics, distilled from the field. This article is part of an ongoing series from Sophos frontline security operations specialists, sharing the expertise they use to strengthen our industry-leading Managed Detection and Response (MDR) service and defend customers against evolving AI Era threats. If you’ve opened the Enterprise ATT&CK matrix recently, you may have done a double-take. The familiar Defense Evasion column is gone.
Read Post
UTMStack

MITRE ATT&CK Framework: A Practical Guide for SOC Teams

Aug 13, 2026 By cesmng In UTMStack
You are already in the meeting, and the question on the table sounds simple: can the SOC detect a technique tied to a noisy intrusion path? Three analysts answer three different ways because each one is staring at a different dashboard, a different log source, and a different mental model. The MITRE ATT&CK framework gives those people one shared way to describe adversary behavior, so the discussion starts with evidence instead of guesswork.
Read Post
datadog

Automatically enrich security logs with MITRE ATT&CK context before they reach your SIEM

Jun 24, 2026 By Danielle Park In Datadog
To detect and investigate threats, security teams need to collect telemetry data from identity providers, cloud platforms, web application firewalls, and endpoints. But these diverse sources describe the same tactics, techniques, and procedures (TTPs) differently according to their own vendor-specific language. For example, a failed Windows logon appears as an event ID, while an Okta account lockout appears as an identity event.
Read Post
armo

MITRE ATLAS for AI Agent Attack Detection: A Complete Mapping

May 17, 2026 By Ben Hirschberg In ARMO
MITRE ATLAS catalogs sixteen tactics and eighty-four techniques adversaries use against AI systems, including fourteen agent-focused techniques added through the October 2025 Zenity Labs collaboration. It is the canonical taxonomy a security architect’s CISO, auditor, or RFP will name. It is not a detection plan. ATLAS organizes around adversary objectives.
Read Post
bitsight

How to Use the MITRE ATT&CK Framework as a Shared Language for SOC, CTI, GRC, and Leadership

Apr 22, 2026 By Emma Stevens In BitSight
Picture the first meeting after a serious security event. The Security Operations team is talking about alerts, detections, and lateral movement. Threat Intelligence is talking about adversary tradecraft and known campaigns. Governance and Risk is talking about control gaps, exposure, and business risk. And leadership? They only care about how bad this event is, and what the team is doing about it. Security teams often agree on the mission: deter and stop threat actors at all costs.
Read Post
datadog

CI/CD security: threat modeling using a MITRE-style threat matrix

Apr 8, 2026 By Juvenal Araujo In Datadog
Source code management (SCM) and CI/CD pipelines have become the industry standard for automating software delivery. But from the time a code change enters your SCM until it’s deployed, it’s susceptible to changes and reconfigurations that can go so far as to modify the pipeline itself. If you’re not proactively securing your CI/CD system, attackers can use it to grant themselves permissions, access secrets, and ship malicious code.
Read Post

Episode 7 - Practical AI for Zeek, MITRE, and Security Docs

Jan 29, 2026 By Corelight In Corelight
In Episode 7 of Corelight DefeNDRs, join me, Richard Bejtlich, as I sit down with Dr. Keith Jones, Corelight's principal security researcher, to discuss the practical applications of AI in enhancing network security. We delve into how large language models (LLMs) can assist in cleaning up documentation and generating Zeek scripts, sharing insights from our extensive experience in incident response and coding. Keith reveals the challenges and successes he has encountered using LLMs to streamline processes, including their role in analyzing MITRE techniques.
View Video

Decoding MITRE ER7: How to Interpret Results That Matter

Jan 20, 2026 By WatchGuard Technologies In WatchGuard
MITRE ATT&CK Evaluations attract strong attention across the cybersecurity industry by providing detailed, transparent data on how endpoint security solutions behave under real attack conditions. However, the depth of the results often makes them difficult to interpret and compare meaningfully. Join Field CTO Adam Winston as he decodes WatchGuard’s MITRE ER7 results and learn how to weigh key metrics to determine real-world security effectiveness and efficiency.
View Video
WatchGuard

MITRE ER7 Explained: From Detection to Operational Efficiency

Jan 18, 2026 By Iratxe Vazquez In WatchGuard
MITRE ATT&CK ER7 results are often reduced to simple headlines: detection percentages, prevention rates, or “100% coverage” claims. But those numbers alone don’t explain how a security platform actually behaves when an attack unfolds, nor how much operational effort is required to manage it. To understand the real impact of ER7 results, you need to look at detection efficiency and operational efficiency, not just raw coverage.
Read Post
exabeam

Decoding the 2025 MITRE ATT&CK Evals: A Call for Clarity and a Guide for Analysts

Jan 13, 2026 By Exabeam In Exabeam
The latest MITRE ATT&CK Enterprise Evaluations are out, featuring scenarios that emulate sophisticated actors like Scattered Spider and Mustang Panda. While every release of the findings is a significant event for the security community, this year’s evaluation highlights both new and recurring concerns for security professionals.
Read Post

Copyright © 2026 OpsMatters™. All rights reserved.