MITRE ATLAS (Adversarial Threat Landscape for Artificial-Intelligence Systems) is a knowledge base that documents real-world tactics and techniques bad actors use to attack AI and machine learning systems. Built by MITRE and modeled on the ATT&CK framework, it gives security teams a shared language for AI-specific threats.
Key takeaways
- MITRE ATLAS is a knowledge base cataloging real-world attacks against AI and machine learning systems.
- It’s modeled on MITRE ATT&CK but built specifically for AI-unique risks like model extraction, data poisoning, and prompt injection.
- The matrix organizes attacker behavior into tactics: reconnaissance, ML model access, execution and exfiltration, and impact, among others.
- Expel labels detections against MITRE ATLAS directly inside Expel Workbench™.
- Mapping your own AI/ML systems to ATLAS starts with an asset inventory, not a bigger security budget.
AI and machine learning systems are now part of daily operations for most companies, and that means they’re now part of the attack surface too. MITRE ATLAS gives security teams a way to think about that risk without starting from scratch. It’s part of the broader world of AI in cybersecurity, extended specifically to cover how bad actors target models, training data, and ML pipelines.
What is MITRE ATLAS?
MITRE ATLAS is a public knowledge base that catalogs how bad actors attack artificial intelligence and machine learning systems in the real world. Think of it as a field guide to AI-specific attacks, built from documented incidents and red team findings rather than theory.
MITRE built ATLAS as a companion to its ATT&CK framework, using the same tactics-and-techniques structure security teams already know. Instead of covering general IT infrastructure, ATLAS focuses on the parts of the stack that make AI systems unique: training data, model weights, inference APIs, and the pipelines connecting them.
Each entry in the matrix maps to a specific way an attacker might target a model—things like adversarial machine learning techniques that trick a model into misclassifying input, or attacks that extract sensitive training data through repeated queries.
MITRE ATLAS vs. MITRE ATT&CK
MITRE ATLAS and MITRE ATT&CK share a family resemblance on purpose. They use the same tactic-and-technique format and same MITRE pedigree. The difference comes down to what’s being attacked.
| Aspect | MITRE ATT&CK | MITRE ATLAS |
|---|---|---|
|
Focus |
Traditional IT: networks, endpoints, cloud, identity | AI and machine learning systems |
|
First released |
2013 | 2021 |
|
Structure |
Tactics & techniques matrix | Tactics & techniques matrix (same format) |
|
Example tactic |
Initial access via phishing | ML model access via API abuse |
|
Case studies |
Enterprise breach reporting | Documented attacks on production ML systems |
|
Typical users |
SOC analysts, threat intel teams | ML engineers, AI red teams, SOC analysts |
The MITRE ATLAS matrix: Tactics and techniques explained
Reconnaissance: Bad actors research a target’s AI systems before touching them by scouring published papers, model cards, and public repos.
Resource development: Attackers build or acquire what they’ll need, like training their own shadow models to test attacks against.
Initial access: This covers how an attacker gets a foothold by taking actions like compromising a supply chain dependency, exploiting a public-facing ML API, or slipping a poisoned dataset into a training pipeline.
ML model access: Unique to ATLAS, this tactic covers how attackers reach the model itself, whether it’s through an exposed inference API, a stolen model file, or a compromised ML development environment.
Execution, persistence, and exfiltration (ML-specific): Once inside, attackers run adversarial inputs, plant backdoors that survive retraining, or use prompt injection to manipulate a model’s outputs.
Impact: The end goal of attackers—degraded model accuracy, stolen intellectual property, biased or manipulated outputs, or a model that behaves unpredictably in production.
How does MITRE ATLAS help secure AI systems?
MITRE ATLAS helps secure AI systems by giving security teams a common framework to identify, prioritize, and defend against attacks that traditional security tools weren’t built to catch. Before ATLAS, most security teams treated AI systems like any other software—patch it, monitor it, move on. That approach misses threats unique to how models actually work, like data poisoning during training or extraction attacks that steal a model’s logic one query at a time.
With ATLAS, teams can map their own AI/ML systems against known attacker techniques, spot gaps in visibility, and build detections that account for the ML-specific parts of the attack surface. For security leaders, ATLAS provides a shared vocabulary. When a data scientist, a SOC analyst, and a CISO can all point to the same matrix, threat modeling gets faster.
Who uses MITRE ATLAS and why it matters now
ATLAS started as a resource for ML engineers and AI red teams, but it’s moved well beyond that. Threat intelligence teams use it to track emerging AI attack techniques. SOC analysts use it to understand what an alert involving a model or ML pipeline actually means. Governance and risk teams use it to answer questions about AI risk that regulators and boards are increasingly asking.
Why now? AI adoption inside companies has outpaced most security teams’ ability to monitor it, and bad actors have noticed. Attacks against production ML systems aren’t hypothetical anymore. They’re documented, cataloged, and growing in ATLAS itself.
How Expel uses MITRE ATLAS for detection labeling in Workbench
Expel is a managed detection and response (MDR) provider, and most of our detection engineering has historically been mapped to MITRE ATT&CK. As AI and ML systems started showing up more in customer environments, that left a gap for detections that fired on ML-specific behavior with no framework to describe them.
As part of our MDR for AI attack surface launch, we now label detections against MITRE ATLAS as well, so analysts get the same kind of context AI-related alerts that they already get for traditional ATT&CK-mapped ones.
This isn’t about replacing an analyst’s judgment with automation, it’s about giving analysts better context, faster. Workbench stays human-led, AI-powered, same as everywhere else in the platform.
How to start mapping your own AI/ML systems to MITRE ATLAS
- Inventory your AI and ML assets. List every model, training pipeline, and ML-powered feature in production, including ones built on third-party APIs.
- Match assets to ATLAS tactics. A public-facing chatbot has a different risk profile than an internal fraud-detection model.
- Cross-reference existing detections. Most teams find gaps around ML model access and data poisoning specifically.
- Build or borrow threat hunting techniques for your highest-risk AI systems, using ATLAS techniques as the basis for what to test against.
- Revisit regularly. ATLAS gets updated as new techniques are documented.
Frequently asked questions
What is MITRE ATLAS in simple terms?
MITRE ATLAS is a catalog of real-world ways bad actors attack AI and machine learning systems, organized the same way MITRE ATT&CK organizes traditional cyberattacks.
How is MITRE ATLAS different from MITRE ATT&CK?
ATLAS focuses on AI and machine learning systems instead of traditional IT infrastructure. Both use the same tactics-and-techniques matrix format, but ATLAS covers threats like model extraction, data poisoning, and prompt injection.
How does MITRE ATLAS help secure AI systems?
It gives teams a structured way to identify and defend against attacks unique to how models actually work, replacing guesswork with a documented, real-world set of tactics and techniques.
Who should be using MITRE ATLAS?
Anyone responsible for building, securing, or monitoring AI and machine learning systems—ML engineers, AI red teams, SOC analysts, threat intelligence teams, and security leaders.