TL;DR
- AI-related detections in Expel Workbench™ carry MITRE ATLAS tactic and technique labels alongside the ATT&CK labels our analysts already use.
- Two rules keep the matrix honest: one primary technique per detection, and label the behavior the detection observed rather than the intent you suspect.
- For an analyst who’s never seen a given pattern, the label supplies the tactic, the adjacent techniques, and a short hunting list in about a minute.
AI has forever changed the threat landscape, but it didn’t change how detection engineering fundamentally works. Writing good detections is still your best bet at stopping AI-shaped attacks. So what does “good” look like?
The discipline is the same one we’ve run in a production SOC for more than a decade. The formula is to get the right telemetry, know what an attacker is actually trying to do, and put a human on the important signals; what’s new is the surface. Employees are wiring assistants into internal systems. Agents are taking actions and have unfettered access to your sensitive data. And attackers are probing all of it. Our job is to detect and respond to that activity the same way we’ve always detected everything else.
This month we launched MDR for AI and an integration with Anthropic (the first of many) to help our customers make sense of defending the new AI frontier. Here’s how our detections actually work to stop AI threats.
Three domains, and why you need all three
AI risk isn’t one thing, so we don’t treat it as one thing. Our detection strategy covers three domains:
- AI-assisted attacks: AI in the attacker’s hands. Enhanced phishing and business email compromise (BEC), AI-accelerated exploit development, AI-assisted lateral movement and exfiltration, and deepfake and synthetic-identity fraud. The tradecraft is faster and cheaper, but it still lands as attacker activity in your environment, which means we already detect a lot of it.
- AI exposure: Risk from your own people. Shadow AI and unapproved tools, sensitive data going into an assistant, over-shared workspaces, and vendor data-retention exposure. No attacker required; the exposure is self-inflicted and easy to miss and prevent.
- Attacks on your AI systems: Your models, assistants, and agents as the target. Direct and indirect prompt injection, agents acting with excessive permissions, non-human identity sprawl, agents taking rogue or dangerous actions.
The reason to cover all three is simple: Attackers don’t respect your taxonomy. A prompt injection (domain 3) exists to trigger an action, and that action often looks like exfiltration (domain 1) using an identity your governance never accounted for (domain 2). Cover just one domain, and you catch the middle of an attack chain while missing the setup and the payoff. Coverage across all three is what lets an analyst follow the activity end-to-end, instead of catching a fragment and guessing at the rest.
MITRE ATLAS: ATT&CK for AI systems
If you run a SOC, you already think in MITRE ATT&CK tactics (what the attacker is trying to accomplish) and techniques (how they do it). It’s the shared language that lets an analyst who’s never seen a specific alert still know what stage of an attack they’re looking at.
MITRE ATLAS is the same idea, built for the AI attack surface. It catalogs the tactics and techniques adversaries use against AI-enabled systems—prompt injection, model evasion, data poisoning, and the rest—in the same tactic-and-technique structure. It’s a new framework for a quickly changing attack surface, and it has become the most common reference point practitioners reach for when the target is an AI system rather than a laptop or a domain controller.
We’ve mapped our detections to it—both our existing library and the new Claude detections. AI-related detections in Expel Workbench™ carry MITRE ATLAS tactic and technique labels alongside the MITRE ATT&CK labels our analysts already use. You can see this live in Workbench—every detection, labeled where AI is a factor, mapped to the framework and soon to be queryable via API.
Why ATLAS visibility matters to you
When it comes to coverage, you need to actually be able to see how your coverage stacks up against the field in order to baseline and continue to improve.
Mapping to ATLAS lets us show you—in your own tenant—exactly which attacker tactics we detect across both conventional and AI-powered systems, using a framework you can independently read, question, and compare us against. When a detection fires, the ATLAS label tells your team what stage of an attack they’re looking at without needing a vendor to translate. And when you’re deciding where your real gaps are, a coverage map framed in ATLAS terms is a lot more useful than a marketing slide. It also makes honest conversations possible, which brings us to the part most vendors skip.
Coverage today: 13 of 16 MITRE ATLAS tactics (and why)
ATLAS defines 16 tactics, and we cover 13
The three tactics we don’t cover are Reconnaissance, Resource Development, and AI Attack Staging. We’re not behind on them, and they’re not sitting in a backlog. They’re structural zeros, and it’s worth being clear about why.
All three describe work the attacker does on their own side, before they ever touch your environment—researching a target, building or acquiring capabilities, or staging and crafting the attack. A SOC sees activity inside the environments it monitors. It cannot see an adversary reading your docs on their own machine, or fine-tuning a proxy model in their own lab. That telemetry doesn’t exist on your side of the line, so no SOC-based approach—ours or anyone’s—detects it from your environment.
Our Claude integration: Control plane and content plane
We’re now in early access for the Expel Claude integration—the first AI-native integrations of many. It lets us detect and respond to threats tied to attacks on your AI infrastructure, attacks leveraging it, and the risky things employees do inside these tools. It works across two planes:
- Control plane: The usage and administrative layer—who logged in, who changed a setting, who ran what, which tools an assistant can reach. This is where most AI integrations stop.
- Content plane: The substance flowing through—prompt content and tool use, not just the fact that a prompt happened. This is where intent lives.
The distinction matters more than you might think. Control plane telemetry tells you something happened. Content plane telemetry tells you what someone was trying to do. Our early access Claude integration pulls Claude Enterprise Compliance signals into the detection pipeline—prompt content and tool use alongside the usage activity. Prompt-level signal is what makes the next detection possible at all.
Walkthrough: Mapping one detection
Let’s put our AI coverage into practice. Most integrations that pull AI platform telemetry stop at activity logs—who logged in, who changed a setting, who ran what. That tells you something happened. It doesn’t tell you what someone was trying to do. Here’s what the content plane signal unlocks.
An employee uploads a PDF from an outside vendor into a Claude workspace that has tools wired into internal systems. Buried in that PDF, in 4pt white text, is an instruction telling the assistant to search for anything containing credentials and summarize what it finds.
The assistant follows the instruction. It was built to follow instructions.
What the detection sees: Prompt content carrying instruction-shaped text the user never typed, followed by a tool call whose query pattern has no relationship to what the user actually asked for.
How we label it—two techniques, in sequence:
- Prompt injection as the entry technique—specifically the indirect variety, since the instruction arrived inside content the model consumed rather than from the person at the keyboard.
- Tool misuse as the follow-on technique, covering what the injected instruction actually made the agent do.
That labeling is what turns a raw signal into something an analyst can work. An operator who’s never seen this exact pattern can pull the ATLAS technique, read the adjacent techniques under the same tactic, and have a path forward inside a minute.
And note who’s doing that work. Our operators work the signal directly, rather than handing it to an automated feed for you to watch on your own. Human-led, AI-accelerated.
So what’s next?
The Claude integration is the first AI-native source, but there’s more to come throughout 2026 and beyond. As we add sources, the content plane picture gets richer, and the ATLAS coverage map fills in further—always with the same honesty about what SOC telemetry can and can’t see. API access to the mapping is coming. And of course the human on the other end of the signal isn’t going anywhere.
Frequently asked questions
Does Expel label every AI-related detection against MITRE ATLAS?
Expel’s detection library is labeled wherever AI is a factor and mapped to MITRE ATLAS, covering 13 of the 16 ATLAS tactics at launch. The labels are visible in Workbench and queryable through the API, and coverage expands as the framework itself expands.
Do I need to already know MITRE ATLAS to use these detections?
No. The ATLAS label is a reference layer on top of the detection logic itself, so analysts can triage the detection normally and use the ATLAS mapping as added context.
How is this different from the MITRE ATT&CK labeling Expel already uses?
ATT&CK labeling covers traditional IT attack techniques. ATLAS labeling is specific to techniques targeting AI and machine learning systems, so ATLAS runs as a parallel, AI-specific labeling layer rather than a replacement.
