MITRE released ATT&CK v20 on October 13, 2026, bringing significant updates to one of cybersecurity’s most widely used frameworks for understanding adversary behavior.
The latest release expands coverage of AI-enabled attacks, identity-based threats, and attacks targeting critical infrastructure. It also introduces new detection strategies and updates the techniques security teams use to understand how attackers operate.
For security leaders, the question isn’t simply what’s changed in the framework.
It’s whether those changes expose gaps in their security programs, and what they should do about them.
That’s where we’re focusing our efforts with Acuity.
What’s New in MITRE ATT&CK v20?
ATT&CK v20 reflects how quickly the threat landscape is evolving, particularly as attackers begin exploiting AI systems and autonomous capabilities.
Several updates stand out.
1. AI is now part of the attack surface
MITRE has introduced techniques covering direct and indirect prompt injection, AI-enabled data exfiltration, manipulation of AI-generated results, and interference with autonomous defenses.
These additions recognize that AI systems aren’t simply tools defenders use. They’re increasingly systems attackers can manipulate, exploit, or turn against an organization.
2. Identity and authentication threats continue to evolve
The release adds coverage for stealing application-specific passwords and techniques designed to evade automated security mechanisms, including CAPTCHA protections.
These changes reinforce the importance of understanding how identity controls work together, rather than evaluating each technology in isolation.
3. Critical infrastructure receives expanded attention
New campaign coverage includes attacks against U.S. water utilities, while updates to industrial control system (ICS) techniques improve visibility into execution and command-and-control behaviors.
MITRE has also added asset and platform context to ICS detection strategies, helping defenders understand where particular detections apply.
4. Detection guidance continues to mature
The Enterprise framework now contains 703 detection strategies and 1,770 analytics. These provide increasingly detailed guidance for understanding how adversary techniques might be identified.
But having detection guidance available doesn’t necessarily mean an organization has the tools, configurations, or processes needed to implement it.
And that’s an important distinction.
Why This Matters to CISOs
Most security leaders aren’t starting from scratch.
They already have security tools, documented controls, policies, assessments, and teams responsible for managing risk. Many have mapped their security programs to frameworks such as NIST CSF, CIS Controls, and MITRE ATT&CK.
The challenge is understanding how everything connects.
Consider a new ATT&CK technique involving AI-enabled data exfiltration.
A security leader should be able to answer several questions:
- Is this technique relevant to our environment?
- Which of our existing controls help protect against it?
- Which security tools provide detection or prevention capabilities?
- Are those capabilities configured, validated, and operating effectively?
- If we have a gap, what would it cost to address?
- How important is that investment compared with our other security priorities?
Answering those questions often requires information scattered across multiple systems, spreadsheets, assessments, and teams.
The problem isn’t a lack of security information. It’s the difficulty of turning that information into decisions.
How We’re Incorporating ATT&CK v20 into Acuity
At ProSentra, we built Acuity around a fundamental idea: security programs should be managed as connected systems, not isolated collections of controls, technologies, and assessments.
MITRE ATT&CK is an important part of that model because it provides a common language for understanding adversary behavior.
As we incorporate ATT&CK v20 into the Acuity platform, our focus extends beyond updating a list of techniques.
We want those updates to inform how organizations evaluate their security posture and prioritize improvements.
Connecting threats to existing controls
Acuity connects threats, security controls, technologies, people, and investments within a unified security program model.
Incorporating the latest ATT&CK techniques allows us to evaluate how newly documented adversary behaviors relate to existing defensive capabilities.
Rather than requiring security leaders to manually interpret every framework change, our goal is to make the potential impact on their programs easier to understand.
Identifying meaningful coverage gaps
A new threat technique doesn’t automatically mean an organization needs another security product.
Existing controls may already provide adequate protection. In other cases, a capability may exist but isn’t configured or operating effectively.
Acuity’s approach is to examine these relationships before recommending additional investment.
The objective isn’t to maximize the number of controls or technologies an organization deploys.
It’s to understand where protection is sufficient, where it is weak, and where improvements will make the greatest difference.
Prioritizing investments based on risk
Not every ATT&CK technique is equally relevant to every organization.
A manufacturer operating industrial control systems faces different threats than a financial services company or a healthcare provider.
Security leaders need to evaluate threats in the context of their own environments, existing capabilities, and business priorities.
Acuity brings these considerations together to support more informed investment decisions.
The result should be a clearer understanding of what to improve, why it matters, and how it affects the overall security program.
Keeping security programs aligned with evolving threats
Security posture isn’t static.
Threats change. Technologies evolve. Controls improve. New vulnerabilities and attack techniques emerge.
ATT&CK v20 is another reminder that security programs need to evolve alongside the threat landscape.
Our direction with Acuity is to make that evolution easier to manage by connecting changes in threat intelligence to the security program itself.
From Threat Intelligence to Better Decisions
MITRE ATT&CK has become an essential resource because it helps the cybersecurity community understand how adversaries actually operate.
But frameworks alone don’t improve security.
Organizations improve security when they use that knowledge to make better decisions about their defenses, operations, and investments.
That’s the opportunity we see with ATT&CK v20 and Acuity.
The value isn’t simply knowing that a new attack technique exists. It’s knowing whether you’re protected against it, what you’re missing, and what to do next.
At ProSentra, we’re continuing to build that connection between threat intelligence and security program management.
Because understanding the threat is only the beginning. Knowing what to do about it is what matters.
Learn more
Explore the MITRE ATT&CK v20 release notes or contact ProSentra to learn how Acuity helps security leaders connect threats, controls, tools, and investments.