MITRE D3FEND

MITRE D3FEND: The Defensive Side of the ATT&CK Matrix

At a glance (v1.3.0, Dec 2025)
  • 7 tactics
  • 245+ defensive techniques
  • Digital artifact ontology
  • Mapped to ATT&CK technique by technique
  • OT extension since Dec 2025
  • Machine-readable knowledge graph
ATT&CK tells you what attackers do. Almost every organisation stops there - and then has no structured way to answer the obvious follow-up question, which is what to build against it. D3FEND is that answer, and it is the half most people have never opened.
What it is, and what it deliberately is not
D3FEND is a knowledge graph of defensive techniques, published by MITRE, that maps countermeasures to the offensive techniques in ATT&CK. It is not a maturity model, not a control catalogue in the ISO sense, and not something you get certified against. It is a vocabulary - a precise one - for the sentence “this control stops that attack”.

That sounds modest until you try to write the sentence without it. Most security programmes describe controls in vendor language (“we have EDR”) and threats in ATT&CK language (“credential dumping, T1003”), and there is no defined join between the two. D3FEND supplies the join.

Seven tactics, and the order matters
MITRE D3FEND: the seven defensive tacticsRead left to right. Model comes first for a reason: you cannot defend an asset you have not written down.1ModelKnow whatyou have2HardenShrink thesurface3DetectSee ithappen4IsolateContain theblast5DeceiveWaste theirtime6EvictRemove theaccess7RestoreGet backto workv1.3.0 (December 2025): 245+ defensive techniques, plus a dedicated OT extension for controllers,sensors, actuators and industrial network components.

Older material lists five tactics. The current framework has seven, and the two additions are the interesting ones. Model was put at the front because inventory precedes defence: asset mapping, network mapping, operational dependency mapping. Restore was added at the back because getting the system running again is a defensive discipline with its own techniques, not an afterthought handled by whoever is on call.

The middle five are the familiar ones. Harden - application, credential, message and platform hardening; the work that removes options from an attacker before they arrive. Detect - the largest category by far, covering file, network, process, identity and message analysis. Isolate - execution and network isolation, containing the blast radius rather than preventing the blast. Deceive - decoy environments, credentials and objects, which cost an attacker time and generate very high-confidence alerts. Evict - terminating processes, revoking credentials, removing access.

The digital artifact is the whole idea
This is the part that makes D3FEND different from a list of good practices, and it is worth understanding properly.

The join: how ATT&CK connects to D3FENDNot by opinion. By the digital artifact the attack technique has to touch.ATT&CK techniqueProcess HollowingT1055.012What the attacker doesDigital artifactProcess CodeSegmentWhat the action must touchD3FEND countermeasureProcess Code SegmentVerificationD3-PCSVWhat you buildThe artifact ontology is the bridge. It is why the mapping is auditableinstead of a matter of taste.Ask of any control: which ATT&CK technique does it break, and which artifact does it check?

A digital artifact is a thing that exists in a system - a process code segment, an authentication ticket, a DNS query, a network packet. Every attack technique has to touch specific artifacts to work. Every countermeasure operates on specific artifacts. So if you know which artifacts a technique touches, you can derive which countermeasures could possibly stop it, rather than guessing.

Process Hollowing (T1055.012) has to modify a process code segment. Process Code Segment Verification (D3-PCSV) inspects process code segments. The link is not a judgement call - it follows from the artifact both of them touch. This is also why D3FEND ships as a machine-readable ontology: the relationships are structured, so tooling can traverse them.
What changed in December 2025
Version 1.3.0 was a substantial release. The headline was the OT extension, announced on 16 December 2025: new artifacts for controllers, sensors, actuators and OT network components, countermeasures specific to cyber-physical systems, and mappings to other OT resources. For anyone with a production floor, a building management system or industrial control in scope, this is the first time D3FEND has had vocabulary for it.

The release also added a CAD Library for sharing reusable defensive graphs and a CAD IDE for building them. The practical effect is that a defensive design can be published and reused rather than redrawn in every organisation.

One chain, one countermeasure per stepThis is the exercise. Attack step on the left, the D3FEND technique that breaks it on the right.1Phishing mail arrivesATT&CK T1566DETECTD3-MA Message AnalysisD3-SRA Sender Reputation2User enters credentialsATT&CK T1078HARDEND3-OTP One-time PasswordD3-SPP Strong Password PolicyHUMAN3Attacker signs inATT&CK T1078DETECTD3-UBA User Behavior Analysis4Payload runs on hostATT&CK T1204ISOLATED3-EAL Executable AllowlistingD3-EI Execution Isolation5Session must be cutresponse stepEVICTD3-CREV Credential RevokingD3-ACI Auth Cache Invalidation6Access given backresponse stepRESTORED3-RUAA Restore User AccountD3-ULA Unlock AccountStep 2 is marked HUMAN because no technique on that row works without a person doing the right thing.Map every control that depends on human action - that list is where the training budget belongs.

Three ways to actually use it
D3FEND is where good intentions go to die, because it is large and there is no obvious entry point. These three uses are small enough to finish.

1. Label the controls you already own. Take your existing control list - the one in your ISMS or your DORA controls catalogue - and put D3FEND identifiers next to the entries. It takes an afternoon and it immediately shows you where you have four overlapping controls on one artifact and nothing at all on another. This is the highest-value hour in the whole framework.

2. Close the loop after an incident. When you write the post-incident report, map the attack chain to ATT&CK techniques - most teams do this already - then, for each technique, look up the D3FEND countermeasures and ask which ones you had. The output is a specific list of things to build, tied to something that actually happened to you. Far more persuasive to a budget holder than a generic gap assessment.

3. Interrogate vendor claims. When a supplier says their product “stops ransomware”, ask which D3FEND techniques it implements. A good vendor answers immediately. A vague answer is itself the answer. This also works in reverse for your own supplier questionnaires under DORA Article 30.

Score your own coverageOne row per tactic. Count what you actually have, then read the usual gap. The pattern is illustrative, not measured.TACTICCOUNT THESETHE USUAL GAPYOURSModelAsset inventory, network map,dependency mapNo current inventory -so nothing else can be scopedHardenMFA, patching, config baselines,password policyUsually the strongest column- and mistaken for the whole jobDetectSIEM rules, EDR, mail analysis,user behaviour analysisMany tools, few testeddetections. Count rules you have verifiedIsolateSegmentation, allowlisting,sandboxingFlat networks. Everyone canreach everythingDeceiveDecoy accounts, files, hostsAlmost always empty - andone decoy account is a cheap winEvictRevoke credentials, kill sessions,remove filesNobody has timed it. How longto revoke every session today?RestoreTested restores, account recovery,config rebuildBackups exist, restoresuntested. Untested is not a controlTwo honest readings of a first pass: Detect is crowded, Deceive is empty, and nobody has timed Evict.The cheap wins are in the thin columns, not in buying a seventh detection tool.

Work through it now
The same seven tactics, broken into 27 concrete measures with their D3FEND identifiers. Mark what is genuinely in place - partial counts as half. Your answers stay in your own browser; nothing is sent anywhere.



Why it belongs on an awareness page
Two reasons, and neither is obvious.

The first is that D3FEND makes training specific. “Be careful with email” is not a control. “Users report suspected phishing through a one-click button, and reports are triaged within an hour” maps to a defined detection technique with an owner, a measurement and a failure mode. Awareness training built from a defensive framework produces behaviours you can audit; awareness training built from general advice produces a completion rate.

The second is that the human is an artifact-touching component of the system, whether or not the framework says so. The user is the one who approves the MFA prompt, clicks the link, runs the macro, pastes the credential into the wrong window. Several D3FEND detection and hardening techniques only work if a person does something - reports the message, refuses the approval, notices the sender. Mapping which controls in your estate depend on human action is a genuinely uncomfortable exercise, and it tells you exactly where your training budget should go.

The honest limitations
D3FEND coverage is uneven. Detect is richly developed; Deceive and Restore are thinner. Mappings to ATT&CK are not complete, and some are inferential rather than validated. It says nothing about cost, effort or sequencing, so it will not tell you what to do first - that remains your judgement.

And it is not a compliance artefact. Nothing in DORA, NIS2 or the EU AI Act requires D3FEND. What it gives you is the ability to demonstrate that your control set was designed against a documented threat model rather than assembled from vendor recommendations - which is, in practice, what a supervisor or a serious customer is actually probing for.

Related
MITRE ATLAS - the offensive matrix for AI systems
Our cyber security trainings
Warum Cyber Awareness fuer alle Mitarbeitenden
Proof of compliance
Erstellt mit