Experiment: Can AI Map an Incident to MITRE ATT&CK?
A method for testing whether an assistant can correctly match described behaviour to ATT&CK techniques, and where it goes wrong.
2 min readIntermediate Sep 21, 2026
Explain Like I'm Not a Hacker
It is like asking an assistant to file receipts into the right folders, then checking the folders.
The 30-second explanation
Describe what happened in an incident. Ask the assistant which ATT&CK techniques apply. Then check each one against the official descriptions.
How it works
- 1
1. Describe
Write plain summaries of known incidents.
- 2
2. Ask
Request techniques with justification.
- 3
3. Look up
Verify every technique in the official matrix.
- 4
4. Score
Correct, close-but-wrong, or invented.
Take two or three well-understood incidents and write short, plain descriptions of what happened. Ask the assistant to list the tactics and techniques with a one-line justification each. Now look up every technique in the official ATT&CK matrix. Mark it correct, close but wrong, or not real. Assistants can produce plausible-sounding identifiers that do not exist, so the check is essential. This describes a method to run yourself, and no results are claimed here.
Real-world example
The assistant names a technique for a scheduled-task persistence step. You check the matrix and confirm it exists and fits. For another step, it gives an identifier that turns out not to match the description, so you correct it and note the pattern.
How to spot it
Identifiers that do not exist
Plausible IDs with no matching entry.
Right idea, wrong technique
Close but not the best match.
Overlong lists
Many techniques listed with no justification.
No link to evidence
Mappings unsupported by the description.
What to do
- 1Always verify IDs and names against the official framework.
- 2Ask for a justification tied to the evidence for every mapping.
- 3Use the result to decide how much review AI-generated mappings need.
Stay curious. Stay safer.
This is one piece of a bigger picture. Explore more real-world examples, concepts and tips to build your cybersecurity awareness.
Keep reading
- Threat Intelligence
MITRE ATT&CK: The Attacker's Playbook, Published for Defenders
2 min read - Practical Experiments
Experiment: AI vs Human Alert Triage
2 min read - SOC & Blue Team
Threat Hunting: Looking for Attackers Nobody Has Alerted On
2 min read - Security Basics
MFA: The Second Lock That Hackers Can Still Pick
3 min read