What is MITRE ATT&CK in one sentence?

A public knowledge base of the tactics and techniques real attackers use, organized by objective — from initial access to impact.

Why map the pentest to ATT&CK?

Because it turns loose findings into a comparable narrative. Your defense team can read which techniques ran, verify whether they detected them, and measure improvement between tests. A finding without a frame is an anecdote; with ATT&CK, it is operational data.

Does ATT&CK replace the vulnerability report?

No: it complements it. The technical finding says what is broken; the ATT&CK mapping says which real technique exploits it and at which attack stage it appears. Together they tell the full story.

← Learn

Framework

MITRE ATT&CK in pentesting

Why mapping a pentest to MITRE ATT&CK turns it into evidence: real techniques, execution order, and comparability across tests. How we use it.

Rekon — hybrid offensive security · 2026-09-17

MITRE ATT&CK is the common language of the offensive side: a public taxonomy, maintained by MITRE, of how real attackers operate. When a pentest is mapped to ATT&CK, it stops being a bug list and becomes a verifiable narrative: these tactics, these techniques, in this order, with this evidence.

What changes for the client

Detectability. Every executed technique can be cross-checked against your EDR/SIEM: did it alert or pass silently? What passed silently is your real detection gap, measured. Comparability. The retest and the next annual test read against the same frame: you see which paths closed and which stayed open. Priority. A “Collection”-stage technique with access to your real data weighs differently than the same technique in a lab: ATT&CK forces ordering by attack progress, not abstract severity.

How we use it at Rekon

Every exploited finding carries its ATT&CK technique and the evidence of execution. Agents propose technique-identified paths; the specialist validates which run under the ROE. The final report includes the full engagement map: which real techniques ran against your environment and which were authorized but not exercised. The ATT&CK map makes sense inside a report with evidence: what a pentest report is. To see it on your environment: #contacto.

Straight answers

What is MITRE ATT&CK in one sentence?: A public knowledge base of the tactics and techniques real attackers use, organized by objective — from initial access to impact.
Why map the pentest to ATT&CK?: Because it turns loose findings into a comparable narrative. Your defense team can read which techniques ran, verify whether they detected them, and measure improvement between tests. A finding without a frame is an anecdote; with ATT&CK, it is operational data.
Does ATT&CK replace the vulnerability report?: No: it complements it. The technical finding says what is broken; the ATT&CK mapping says which real technique exploits it and at which attack stage it appears. Together they tell the full story.

Time to test your doors?

Tell us what needs validating. We answer with proposed scope, not a brochure.

Talk to Rekon More in Learn