MITRE ATT&CK Protection Strategies: Building the Model Together

For years, the cybersecurity community has used MITRE ATT&CK® to understand how adversaries operate and how to respond. ATT&CK mitigations describe the security concepts and classes of technology that can keep a technique from succeeding, such as privileged account management or execution prevention.  

Detection Strategies, launched in the ATT&CK v18 (October 2025), gave detection engineers a structured way to map telemetry and analytics to adversary behavior, answering the question: how do I know the adversary did this? 

Today’s ATT&CK mitigations tell organizations what category of control to consider. They do not tell you what to configure, where to enforce it or how to prove it keeps working.  

MITRE is now addressing this by asking the in-depth security control prevention questions: 

• What has to be true in the environment for this adversary behavior to fail (prevented outcome), and 
• What allows it to succeed (not prevented outcome)? 

What is unprecedented and encouraging is that MITRE is asking the community to help shape ATT&CK protection strategies before release. If you own preventative controls, this is your chance to influence how the industry defines “protected” and “not protected” for specific security control configuration mitigations. 

Key Takeaways 

• Protection is getting its own ATT&CK model. MITRE is building out protection strategies in the ATT&CK framework to define what must be true for adversary behavior to fail and succeed, planned for release in 2027. 
• Practitioners can shape the working model now before it is final. MITRE wants feedback now from security practitioners to stress test this new model that runs preventative controls, security architecture, identity, endpoint and countermeasure engineering. 
• Fully aligned the vision for the Cymulate Platform. This new model for protection strategies is aligned with our vision for the Cymulate Platform: agentic cyber defense engineering with a closed loop that continuously proves, prioritizes and adapts. Protection strategies give that loop a sharper prevention side, with specific, actionable mitigation for missed preventions. 

Prevention finally gets its own playbook 

The 2025 release of MITRE ATT&CK Detection Strategies defined the telemetry and analytics needed to identify the behavior and answer the question: “How do I know the behavior happened?” 

Protection strategies will define the conditions and controls that must be in place for the behavior to fail and will answer the question: “How do I make sure this behavior fails (a prevented outcome) and keeps failing?” 

Prevention is rarely a one-line mitigation. Telling a team to “enable credential protection” or “restrict macros” isn’t enough. Real prevention depends on the platform and behavior. It also depends on where and how a control is actually enforced and how broadly it is enforced across the systems that need it. The right mitigation for a given technique can look very different depending on the operating system and the technologies in your environment. 

I remember this well from my years conducting threat-based cybersecurity assessments of government enterprise architectures and developing a zero-trust assessment model for the federal government. It was often difficult to turn guidance into action when a single ATT&CK technique had five or more recommended mitigations mapped to it, such as Antivirus/Antimalware, Software Configuration, Execution Prevention, Account Use Policies. How many of those mitigations were needed, and how would we know they were implemented correctly? Don’t get me wrong, those are the right mitigation categories, but the guidance was vague for a security analyst to act on. They didn’t say what to configure, on which platform or how to confirm the control was working and hadn’t drifted over time. 

That experience taught me a lesson that still holds:  

• Deployed is not the same as enforced, and 
• Enforced does not automatically guarantee secure. 

A prevention control can be implemented, but not enforced on every system that needs it. It can also be enforced, but misconfigured, or quietly weakened by an exclusion, an update or even an attacker maliciously disabling it. These protection strategies tackle the first two gaps by defining exactly what to configure, how to verify it and how to detect drift. Closing the third gap, proving the control actually stops the behavior, requires adversarial exposure validation, formerly referred to as breach and attack simulation (BAS). This is where Cymulate fits in. 

What are MITRE ATT&CK protection strategies? 

MITRE recently announced the new protection strategies model in a LinkedIn post. This model will define protection strategies with specific security control configurations needed for an adversary technique to fail. Each strategy covers individual operating systems and explains what to configure, how to verify the control is enforced and how to detect drift over time. 

Instead of waiting for a finished release planned for 2027, MITRE has shared working versions of four protection strategies and has invited the community to help stress-test them before they’re finalized. This is an exciting opportunity that the security community does not want to miss. 

Let’s take a closer look at this model. At a high level, for each protection strategy, MITRE is defining the following for each operating system and security control: 

Protection strategy example: T1566.001 spearphishing attachment (PRT-0001) 

Let’s take the Spearphishing Attachment protection strategy as an example and break it down to further understand their model and the outcomes it is designed to produce.  

The draft Protection Strategy for T1566.001 Spearphishing Attachment is PRT-0001. MITRE documents three operating systems, each with its own protection requirement statement and three associated security control configurations. Let’s take the Windows OS as an example and look at one of the security control configurations. 

Below is a table with the security control information that each configuration includes, using one Windows example.

The example above focused on one of the three Windows security control configurations. The figure below highlights the complexity and level of detail required for each security control configuration for one protection strategy. To ensure necessary threat resilience, it doesn’t stop at deploying the control; an organization must verify that it is enforced everywhere it should be and monitor for drift so it is not weakened over time. 

MITRE wants to hear from defenders 

MITRE is looking for feedback from the community to stress test this protection strategy model with the shared working examples. They asked to hear from people who work in: 

• Preventative controls and countermeasure engineering 
• Security architecture 
• Platform security 
• Identity 
• Endpoint 

Security practitioners know the gap between a control that is "deployed" and a control that actually blocks. They know which settings silently revert after an agent update, which exclusions creep into EDR policies and which identity hardening steps break business workflows.  They also understand the challenges in verifying compliance across their enterprise. That operational reality is exactly what will make protection strategies useful instead of theoretical. 

They also shared a link to join their Slack community to provide inputs and stay up to date. If you own preventative controls, it is worth joining. 

How this is aligned to the vision for the Cymulate Platform 

This new model for protection strategies in the ATT&CK framework is aligned with our vision for the Cymulate Platform to deliver agentic cyber defense engineering. We see exposure validation as an operational engineering capability, not a periodic audit. The goal is a continuous and automated loop where controls are tested against real attacker behavior, gaps are found and automatically closed with precise guidance, and then the fix is verified. Prove, prioritize and adapt. Protection strategies give that loop a sharper prevention side. 

The Cymulate Platform has the industry’s largest library with more than 115,000 attack scenarios, Each attack scenario is mapped to MITRE ATT&CK techniques and their associated mitigations. When a scenario runs and a control fails to block it, analysts don’t get a generic label like “Execution Prevention.” They get remediation guidance tied to that specific missed prevention, so they know what to change and where. 

This connects the abstract and the operational. A failed test isn’t just a red mark on a heat map. It points to a technique, the mitigation that should have stopped it and the steps to close the gap. Security teams can then re-run the same scenario to confirm the fix holds and keep testing to catch drift over time. 

Cymulate stays aligned with every MITRE ATT&CK update, ensuring scenario mappings and mitigation guidance keep pace as the framework evolves. As protection strategies mature, these more detailed, platform-specific mitigations can be displayed directly in the platform and become part of the agentic cyber defense engineering closed loop. Security analysts will see exactly how a prevention control should be enforced for their operating systems and technologies, see the mitigation in action alongside the test results that show whether it’s working. 

So what is the result? Prevention becomes something teams and AI agents can engineer, measure and maintain, just like detection. Instead of a list of vague mitigations, security teams get a specific and actionable path to validate from a missed attack to a fix and continuous proof that the fix works. 

Share your feedback and discover Cymulate 

ATT&CK protection strategies will shape how the industry defines, measures and reports prevention for years to come. This model will be stronger if it reflects how controls behave in real environments, including where they fail and how they drift. It will also align naturally with agentic cyber defense engineering, where specific security control configurations are both what gets validated and what gets fixed. 

If you work in preventative controls, security architecture, platform security, identity, endpoint or countermeasure engineering, share your feedback with MITRE through their call for input. 

Ready to see your prevention and detection coverage across ATT&CK? Request a Cymulate demo to validate your controls and get the specific mitigations to close the gaps.  See how Cymulate Cowork delivers agentic cyber defense engineering.