atlas.mitre.org

MITRE ATLAS (Adversarial Threat Landscape for Artificial-Intelligence Systems) is a knowledge base of adversary tactics, techniques, case studies, and mitigations for AI systems. You can use it to assess threats by mapping your system's attack surface to ATLAS tactics and techniques, reading the case studies that match your deployment, and turning the listed mitigations into concrete controls. It works best as a structured checklist rather than a one-time lookup: start from your system type, walk the tactics in order, and record which techniques apply and which mitigations you already have.

Step 1: Describe your system and its attack surface

Before browsing ATLAS, write down the facts that determine which entries are relevant:

• Model type and lifecycle stage — training, fine-tuning, or inference only.
• Data and model supply chain — pretrained weights, third-party datasets, plugins, or APIs you do not control.
• Deployment surface — chat interface, agent with tool access, embedded classifier, or RAG pipeline.
• Assets at risk — model integrity, training data, user data, downstream actions the system can take.

This list is what you match against ATLAS entries. A model you only call through an API has a different exposure than one you fine-tune on internal data.

Step 2: Walk the tactics to locate relevant techniques

ATLAS organizes adversary behavior into tactics (the adversary's goal at a stage of an attack) and techniques (how the goal is achieved). Read the tactics as an attack chain and, for each, ask whether your system is exposed:

1. Reconnaissance — can an adversary learn about your model, its training data, or its API behavior?
2. Resource development — could someone obtain or build the models, data, or tooling needed to attack you?
3. Initial access — how could an adversary get a foothold (compromised model artifacts, malicious plugins, poisoned data)?
4. ML model access — what does an attacker gain from querying or otherwise reaching the model?
5. Execution, persistence, and privilege escalation — can a compromised model or pipeline run code, persist, or gain broader access?
6. Defense evasion — could inputs be crafted to avoid detection or filters?
7. Discovery and collection — what could be extracted about the model, its data, or its users?
8. Exfiltration and impact — what is the worst realistic outcome (model theft, data leakage, manipulated outputs)?

For each tactic, note the techniques whose preconditions match your Step 1 list. Skip techniques that require access you do not expose.

Step 3: Use case studies to understand the attack chain

ATLAS case studies document real or demonstrated attacks against AI systems. Use them to move from an abstract technique to a concrete sequence:

• Find case studies whose target resembles your system (same modality, similar deployment, similar data sensitivity).
• Trace the chain from initial access to impact, and mark the step where your current controls would have intervened.
• Note the assumptions the case study makes — a demonstration may rely on access or resources your adversary would not have.

This is where assessment becomes specific: instead of "prompt injection is a risk," you get "an attacker who can submit text to our support chatbot could attempt to reach the tool-calling layer, and our only control is an input filter."

Step 4: Convert mitigations into controls and monitoring

Each technique entry lists mitigations. Turn them into an actionable table rather than a reading list:

For each gap, decide whether to prevent, detect, or accept the risk, and assign an owner. Mitigations that are detection-oriented (logging, monitoring, anomaly alerts) are often cheaper to add than prevention and give you evidence that controls work.

Step 5: Validate and keep it current

• Test the assumptions — for high-priority techniques, run a tabletop exercise or a controlled red-team test against a non-production copy.
• Re-check after changes — new model versions, new tools or plugins, and new data sources change your attack surface; revisit the mapping when they change.
• Track updates — ATLAS is a maintained knowledge base, so new techniques and case studies will appear; schedule a periodic review rather than treating the first pass as final.

Common pitfalls

• Treating ATLAS as a scanner. It is a structured knowledge base; the assessment work is the mapping you do, not the site itself.
• Copying every technique. Relevance depends on your exposure — an inference-only API does not inherit training-time risks.
• Stopping at technique names. The value is in the case studies (attack chains) and mitigations (controls), so read those, not just the list.
• Ignoring the human and pipeline layers. Many AI incidents start in data handling, credentials, or integrations rather than in the model itself.

Related questions

• What is MITRE ATLAS and what is it used for?
• How is the MITRE ATLAS knowledge base organized?
• How does MITRE ATLAS relate to MITRE ATT&CK?

MITRE ATLAS™ is organized as a structured knowledge base of adversarial threats against AI systems, built around tactics and techniques and linked to real-world attack case studies and defensive mitigations. You can use it for security analysis if you need a shared vocabulary for describing AI-specific attacks and a way to move from an observed threat to candidate defenses. The site itself provides the framework; the practical value comes from navigating its linked entries rather than reading it as a single document.

The Core Structure: Tactics and Techniques

ATLAS follows the pattern familiar from ATT&CK-style matrices, adapted to AI and machine learning systems:

• Tactics describe the adversary's goal at a stage of an attack (for example, reconnaissance, initial access, or impact). They answer "why" an adversary takes an action.
• Techniques describe how a tactic is carried out against AI components such as models, training data, or deployment infrastructure. Each technique entry typically explains the adversary's method and the systems it applies to.

Tactics and techniques are the backbone: most other content in the knowledge base hangs off these entries.

Case Studies Tied to Real Attacks

ATLAS links techniques to case studies — documented real-world or realistic attack scenarios against AI systems. This is what separates the framework from an abstract taxonomy: a technique entry can point to concrete incidents, so you can see how a described method appeared in practice. When analyzing your own environment, case studies are the quickest way to judge whether a technique is hypothetical or has already been observed.

From Threat to Mitigation

Each technique is associated with mitigations — defensive measures intended to reduce the likelihood or impact of that technique. The mapping runs both ways:

1. Start from a threat you care about (a tactic or technique) and follow its links to recommended mitigations.
2. Start from a control you already have and check which techniques it addresses, to find gaps.

This bidirectional mapping is the main reason to use ATLAS in a security analysis: it gives you a defensible chain from "attack X is possible" to "control Y reduces it."

How to Navigate It for Your Own Analysis

A practical workflow:

• Scope the system. Identify your AI components (data pipeline, model, inference endpoint, integrations).
• Walk the tactics. For each tactic, review the techniques that apply to components like yours.
• Check case studies. Note which techniques have documented precedents relevant to your sector or deployment style.
• Collect mitigations. Pull the linked mitigations for the techniques you flagged and compare them with existing controls.
• Record gaps. Techniques with no matching control become your prioritized findings.

Common Pitfalls

• Treating the matrix as a checklist: coverage of techniques is not the same as a tested control.
• Skipping case studies and over-weighting theoretical techniques.
• Assuming entries are exhaustive — the knowledge base evolves, so re-check entries when you repeat an analysis.

Is It the Right Fit?

ATLAS is a good fit if you need an AI-specific threat vocabulary, traceable links from threats to defenses, and grounding in documented attacks. It is less suited to teams wanting a prescriptive compliance checklist or quantitative risk scores — it supplies structure and references, not scoring. For a first pass, pick one tactic relevant to your deployment and follow its techniques through to mitigations; that single path shows whether the knowledge base's organization matches how your team reasons about risk.

MITRE ATLAS™ is intended for anyone who needs a structured way to reason about threats to AI systems: AI developers, security teams, risk and compliance staff, and researchers. Its content is best used as a shared reference for threat modeling, red-team planning, security training, and risk discussions—not as a certification or a substitute for system-specific testing. When you quote it, cite MITRE ATLAS as the source and note the version or access date, since the knowledge base is updated over time.

Who each audience gets from ATLAS

How the content is meant to be used

ATLAS organizes threat knowledge around tactics (the attacker's goal) and techniques (how the goal is achieved), with case studies of real-world AI incidents. That structure supports four common workflows:

• Threat modeling: walk the tactics to identify which apply to your system, then note the techniques that matter.
• Red-team and tabletop exercises: turn techniques into test scenarios and discussion prompts.
• Training: use tactics and case studies to teach AI-specific attack patterns.
• Risk and compliance discussion: use shared terminology so technical and governance teams describe the same threat consistently.

Citing and reusing content

• Attribute the material to MITRE ATLAS and link to the specific entry you used.
• Record the version or the date you accessed it, because entries and case studies change.
• Quote technique descriptions accurately rather than paraphrasing them into your own control claims.
• Keep ATLAS material distinct from your internal findings so readers can tell source from analysis.

Common pitfalls

• Treating ATLAS as a checklist that guarantees coverage; it is a reference to reason from.
• Assuming every technique applies to every AI system—filter by your architecture and use case.
• Citing an entry without a date, so a later reader cannot tell which version you used.
• Presenting ATLAS as a compliance certification; it supports risk discussion, not attestation.

For a first pass, start with the tactics overview, select the techniques relevant to your system, and record your selections with the ATLAS version you used.

MITRE ATLAS™ (Adversarial Threat Landscape for Artificial-Intelligence Systems) is a knowledge base of adversary tactics and techniques against AI and machine-learning systems, maintained by MITRE. It is used to map how attackers target ML systems, so security and AI teams can assess risk and plan defenses. It is most useful when you need a shared vocabulary for AI-specific threats rather than generic software security guidance.

What ATLAS covers

ATLAS is organized around adversarial behavior against AI systems. Its structure follows the pattern familiar from ATT&CK-style frameworks: tactics describe the adversary's goal, and techniques describe how that goal is carried out. Entries are intended to be concrete enough to reference in threat models and defensive planning.

The scope is AI systems specifically, including machine-learning components and the data and tooling around them. That makes it relevant to teams building, deploying, or defending ML models, not only to traditional security operations.

Who it is for

• Security teams mapping AI-related threats into existing risk processes.
• AI/ML engineers who need to understand how their models and pipelines can be attacked.
• Risk and governance staff looking for a structured reference when assessing AI systems.

How teams use it

1. Threat modeling. Walk through tactics and techniques to identify which apply to your system, then note where controls are missing.
2. Risk assessment. Use technique entries as a checklist when evaluating a model, pipeline, or deployment.
3. Defense planning. Tie mitigations and monitoring to specific techniques rather than to vague "AI security" concerns.
4. Communication. A shared technique reference lets security and ML teams discuss the same threat without redefining terms.

For example, a team deploying a model that consumes external data can use ATLAS to structure a review of how that data or the surrounding tooling could be manipulated, then record which techniques are in scope and which controls address them.

Limits to keep in mind

ATLAS is a knowledge base, not a compliance standard or a scanner. It does not tell you whether a specific system is secure, and it does not replace testing. Treat it as a reference for organizing analysis; the actual assessment still depends on your system, your threat model, and your controls.

The site itself is the authoritative entry point: use it to browse the current tactics and techniques rather than relying on secondhand summaries, since entries are updated over time.

MITRE ATLAS and MITRE ATT&CK are separate, complementary knowledge bases built on the same tactical-technical mindset. ATT&CK catalogs adversary behavior against traditional enterprise IT and network environments; ATLAS catalogs threats and attacks against AI and machine-learning systems. They are not substitutes and not a parent-child hierarchy: an organization that runs both IT and AI workloads should treat them as two lenses on one security program, using ATT&CK for the conventional infrastructure layer and ATLAS for the AI layer, and mapping findings between them where an attack path crosses both.

The shared design logic

Both frameworks organize knowledge the same way in principle: adversary goals are grouped into high-level categories (tactics), and concrete ways of achieving those goals are described as techniques, with real-world or demonstrated procedures attached as evidence. This shared structure is why security teams can learn one and read the other without starting over.

The difference is the object of study:

The table is a working orientation, not a claim that the two catalogs never overlap. An attack that compromises a training pipeline may begin with ordinary credential theft, which is squarely ATT&CK territory, and only later become an ATLAS concern.

Where they diverge in practice

The practical divergence is the attack surface and the evidence base. ATT&CK techniques are described in terms of host, network, and identity observables that most SOC tooling already collects. ATLAS techniques describe manipulation of data, models, and the interfaces around them, which often produce no conventional log signature at all — a poisoned training set or a subtly altered model may look normal to endpoint and network monitoring.

That difference drives how each framework is used. ATT&CK supports detection rules and hunts against telemetry you already have. ATLAS supports threat modeling and testing of AI systems, where the "detection" may be a data-integrity check, a model behavior test, or a supply-chain review rather than a log query.

Using both in security operations

A workable pattern is to keep the frameworks at different layers of the same program:

1. Inventory AI assets separately. List models, training data, pipelines, and the APIs that expose them. These are the assets ATLAS is written for; they usually sit outside the scope of an ATT&CK-based asset inventory.
2. Threat-model the AI layer with ATLAS. For each AI asset, walk the tactics and techniques and ask which apply given how the system is built, trained, and served.
3. Keep ATT&CK for the surrounding infrastructure. The hosts, identities, and networks that train, store, and serve models remain conventional attack surface. Detection engineering and hunting there continue to use ATT&CK.
4. Map the seams. Where an AI attack depends on a conventional intrusion step, record both the ATT&CK technique and the ATLAS technique so responders see the full path rather than half of it.
5. Feed results into one risk register. Two frameworks, one prioritization process — otherwise AI findings and IT findings compete for attention without a common scale.

A concrete example of the seam: an adversary gains access to a model-training environment using stolen credentials (an ATT&CK-style intrusion), then alters training data so the deployed model misclassifies a specific input class (an ATLAS-style AI attack). A team that only tracks ATT&CK sees the intrusion and closes it; a team that only tracks ATLAS sees a degraded model with no idea how it happened. Tracking both reconstructs the chain.

Choosing where to start

If your organization has no AI systems in production, ATT&CK is the relevant framework and ATLAS can wait. If you are deploying or operating ML models — including third-party models and APIs — ATLAS becomes necessary because ATT&CK does not describe the AI-specific failure modes. If you are doing both, start with asset inventory and threat modeling at the AI layer, since that is where most teams currently have the least coverage, and keep ATT&CK running unchanged for the infrastructure underneath.