AI Security Second Brain

MITRE ATLAS

Properties1
descriptionThe ATT&CK-style threat matrix for AI systems — 16 tactics, 173 techniques, 35 mitigations and 63 documented case studies, published as machine-readable data under Apache 2.0.

4 min read

⭐ Star on GitHub

Summary: The ATT&CK-style threat matrix for AI systems — 16 tactics, 173 techniques, 35 mitigations and 63 documented case studies, published as machine-readable data under Apache 2.0.

Sources: raw/MITRE-ATLAS/ (288 cards generated from ATLAS release 2026.06, format 6.0.0)

Last updated: 2026-07-28

ATLAS — Adversarial Threat Landscape for AI Systems — is MITRE’s knowledge base of adversary tactics, techniques and case studies targeting AI. It deliberately mirrors ATT&CK’s structure so that AI threats can be reasoned about with the same vocabulary and tooling as conventional ones.

Why it matters to this vault

Three sources in the corpus recommend ATLAS by name and none of them explain it:

  • Palo Alto’s governance overview calls it “a detailed matrix of potential threats to AI systems” and advises organisations to “map their AI systems to relevant threat categories” (source: raw/Laws/What Is AI Governance_Paloaltonenetworks.md).
  • CoSAI’s framework maps “MITRE ATLAS techniques that apply to each component” across five AI architecture patterns (source: raw/AI-incident-response/Defending AI Systems...md).
  • PITAX cites ATLAS technique IDs directly — AML.T0077 under T12 Link Injection, AML.T0051.002 under T44 Conditional Trigger.

ATLAS is the connective tissue between the offensive catalogue in AI Attack Techniques and the control and compliance material elsewhere in the vault. See atlas-and-pitax.

Structure

ObjectCountWiki page
Tactics16atlas-matrix
Techniques173 (103 top-level, 70 sub)atlas-matrix
Mitigations35atlas-mitigations
Case studies63atlas-case-studies
Relationships272—

Relationship types: achieves (technique → tactic), specializes (sub → parent technique), mitigates (mitigation → technique), employs (case study → technique), sequences (matrix ordering).

Platform tagging — the headline finding

Every technique carries platform tags. The distribution is the single most useful number ATLAS gives you:

PlatformTechniques
Agentic AI114
Generative AI92
Predictive AI71
Enterprise61

Agentic AI is the largest category — larger than generative AI. MITRE’s own accounting says the agent, not the model, is now the dominant attack surface. That corroborates from an independent direction what PITAX’s agentic cluster shows and what AI Act Art 15(5) entirely fails to name.

Maturity ratings

Each technique carries an evidence rating:

  • Realized — 64. Observed in the wild.
  • Demonstrated — 90. Proven by research.
  • Feasible — 19. Reasoned but not shown.

A useful triage axis absent from PITAX: 64 techniques have actually happened to someone.

Relationship to ATT&CK

Only 37 of 173 techniques carry an ATT&CK cross-reference. ATLAS is not an ATT&CK extension — roughly 79% of it describes attack behaviour with no conventional-security analogue. The overlap sits mostly in reconnaissance, resource development and the enterprise-flavoured tactics.

Versioning — a trap worth knowing

ATLAS ships monthly content updates and uses two schemes:

  • Content version — YYYY.MM.N (this ingest: 2026.06, released 2026-06-30)
  • Format version — semver (this ingest: 6.0.0)

dist/manifest.yaml maps releases to files. Two cautions:

  1. dist/ATLAS.yaml is deprecated and no longer updated, but is still served. It sits at format 5.6.0 / release 2026.04. Anything built against it is silently stale.
  2. Format v6 restructured everything. Objects are dicts keyed by ID, and tactic↔technique mapping moved out of technique records into a separate relationships block. Converters written for 5.x produce empty tactic assignments without erroring.

Correct source chain: dist/ATLAS-latest.yaml → v6/ATLAS-latest.yaml → the dated file. The first two are ~20-byte pointers.

How this folder was produced

raw/MITRE-ATLAS/ was generated from the official YAML, not scraped. atlas.mitre.org is a Vue single-page app that serves a 3.7 KB empty shell to any HTTP client — there is nothing to scrape without a headless browser.

The folder retains _ATLAS-2026.06.yaml.source (the exact input) and _gen_atlas.py (the generator, re-runnable for future releases).

One conversion detail: ATLAS prose contains footnote citations of the form <sup>[[7]](url)</sup> and bare [[github]]. Obsidian parses [[x]] as a wikilink, so these produce broken links — 84 of them in a naive conversion. The generator collapses them to ordinary markdown.

Licensing

Apache 2.0, Copyright 2021-2026 MITRE (source: mitre-atlas/atlas-data/LICENSE).

Graph View

Backlinks