MITRE ATLAS, the Adversarial Threat Landscape for AI Systems, is MITRE Corporation's knowledge base of adversary tactics, techniques, and case studies targeting AI and machine learning systems. It is structured similarly to MITRE ATT&CK and is widely used as the threat enumeration behind AI red teaming and detection engineering.
- MITRE's knowledge base of adversary tactics and techniques against AI
- Structured like ATT&CK, so it slots into existing security practice
- Used to plan red teaming exercises and measure detection coverage
- Gives both sides of a vendor conversation a shared, specific vocabulary
Why is MITRE ATLAS important?
ATLAS matters because it gives security teams a shared vocabulary for AI threats that maps cleanly onto the rest of the security program. A team already fluent in ATT&CK does not have to learn a new conceptual structure to reason about AI attacks, which lowers the cost of bringing AI risk into existing detection and response practice.
The practical benefit shows up in conversations that would otherwise stall. Detection coverage reviews and vendor evaluations both move faster when each side can point to a specific ATLAS technique instead of describing a threat in marketing language. "We detect prompt injection" invites a follow-up question. Naming the technique and the tactic it belongs to answers it.
It also functions as a completeness check. Because ATLAS documents real case studies alongside techniques, it is a reasonable test of whether a threat model covers what has actually been observed rather than what is easy to describe.
What is MITRE ATLAS?
MITRE ATLAS is a curated, publicly available knowledge base describing how adversaries attack AI-enabled systems. MITRE maintains it, and its structure deliberately mirrors ATT&CK: tactics represent the adversary's objective at each stage, techniques represent the methods used to achieve those objectives, and case studies document incidents where techniques were observed.
That structure is the reason it has been adopted quickly. Security organizations already use ATT&CK to plan detections and measure coverage, so ATLAS extends an established practice to a new asset class rather than introducing a parallel one.
ATLAS covers the full attack progression rather than a single stage – from reconnaissance against a model, through gaining access to AI resources, to techniques for evasion, exfiltration, and impact. Both traditional machine learning systems and generative AI applications are represented, with agent-relevant techniques a growing part of the matrix.
ATLAS is a threat enumeration, not a control framework. It describes what adversaries do; it does not prescribe what to implement.
Types of MITRE ATLAS tactics and techniques
ATLAS organizes adversary behavior into tactics, each covering an objective, with techniques beneath describing how it is achieved.
Reconnaissance and resource development cover preparation: identifying which models and AI capabilities a target uses, and acquiring what an attack requires. Initial access and ML model access cover reaching the system, whether through conventional intrusion or legitimate query access to a model.
Execution, persistence, and privilege escalation cover establishing and extending a foothold, and these are where agent-specific techniques concentrate, since an agent's tool access and reasoning loop provide both.
Defense evasion, discovery, and collection cover operating without detection and gathering what the attacker came for. Exfiltration and impact cover the outcome – extracting a model or its data, or degrading and manipulating the system's behavior.
Rather than memorize the matrix, most teams use it in one direction: pick the techniques plausible against their deployment, then ask what detects each one.
MITRE ATLAS & Onyx
Onyx maps detections and red team scenarios to MITRE ATLAS techniques and reports against the ATLAS taxonomy in the platform's compliance views, so coverage is expressed in terms a security team can audit rather than in product language.
That mapping runs in both directions, which is the useful part. Agentic Red Teaming probes discovered agents against agent-relevant ATLAS techniques, and the findings flow into AI Security runtime policy, so a technique that succeeded in testing becomes an enforced control. Detection coverage and offensive testing then reference the same taxonomy, which makes it possible to state which techniques are covered by enforcement, which are covered by detection only, and which are not covered at all.
