Experiment: Can AI Map an Incident to MITRE ATT&CK?
A method for testing whether an AI assistant can correctly map described behaviour to MITRE ATT&CK techniques, and where it tends to go wrong.
2 min readIntermediate Sep 21, 2026
Explain Like I'm Not a Hacker
Asking an assistant to file a stack of receipts into the right folders, then checking every folder afterwards: that's roughly the shape of this test.
The 30-second explanation
Describe what happened in an incident. Ask the assistant which ATT&CK techniques apply. Then check each one against the official descriptions.
How it works
- 1
1. Describe
Write plain summaries of known incidents.
- 2
2. Ask
Request techniques with justification.
- 3
3. Look up
Verify every technique in the official matrix.
- 4
4. Score
Correct, close-but-wrong, or invented.
Take two or three well-understood incidents and write short, plain descriptions of what happened. Ask the assistant to list the tactics and techniques with a one-line justification each. Now look up every technique in the official ATT&CK matrix, and mark it correct, close but wrong, or not real at all. Assistants can produce plausible-sounding identifiers that don't actually exist, which is exactly why the lookup step matters. This describes a method to run yourself. What you get out of it depends entirely on the incidents you feed in.
Real-world example
The assistant names a technique for a scheduled-task persistence step. You check the matrix and confirm it exists and fits. For another step, it gives an identifier that turns out not to match the description, so you correct it and note the pattern.
How to spot it
Identifiers that do not exist
Plausible IDs with no matching entry.
Right idea, wrong technique
Close but not the best match.
Overlong lists
Many techniques listed with no justification.
No link to evidence
Mappings unsupported by the description.
What to do
- 1Always verify IDs and names against the official framework.
- 2Ask for a justification tied to the evidence for every mapping.
- 3Use the result to decide how much review AI-generated mappings need.
Stay curious. Stay safer.
This is one piece of a bigger picture. Explore more real-world examples, concepts and tips to build your cybersecurity awareness.
Keep reading
- Threat Intelligence
MITRE ATT&CK: The Attacker's Playbook, Published for Defenders
4 min read - Practical Experiments
Experiment: AI vs Human Alert Triage
2 min read - SOC & Blue Team
Threat Hunting: Looking for Attackers Nobody Has Alerted On
2 min read - Security Basics
MFA: The Second Lock That Hackers Can Still Pick
4 min read