Security Report · github.com/jacobdjwilson

MITRE’s 2021 Survey Finds Limited Regular Use of ATT&CK Despite Broad Awareness

Oct 21, 2026 · Original Report (PDF) ↗

Summary

A survey of 297 cybersecurity professionals found that while 82% knew of MITRE ATT&CK, only 8% used it regularly and 84% lacked thorough mapping to the framework.

Key points

The survey was conducted online in March 2021 and covered 297 cybersecurity professionals.
Although 82% of respondents knew about ATT&CK, only 8% said they used it regularly.
84% reported they did not have a thorough mapping to ATT&CK; 16% said they had thorough analysis mapping data and analytics to its techniques.
Cyber threat intelligence was the most common reported use case (35%), followed by defense analysis (21%) and threat hunting (20%).
Endpoint detection and response was the most commonly reported technology using ATT&CK (44%).
82% said they wanted to learn more about applying ATT&CK, and 73% valued credentials validating mastery of its application.

Article Details

Publisher: Cybersecurity Insiders; commissioned by MITRE Engenuity
Report Period: 2021-03
Scope: Survey on organizational knowledge, use, application, and training related to MITRE ATT&CK among cybersecurity professionals.
Sample Size: 297 cybersecurity professionals
Key Statistics: 82% of respondents knew about MITRE ATT&CK, while 8% reported using it regularly.
84% reported not having a thorough mapping to ATT&CK.
35% identified cyber threat intelligence as their primary ATT&CK use case; defense analysis was 21% and threat hunting 20%.
48% were very or extremely confident in their ability to use ATT&CK; 52% were not very confident.
86% sought educational videos or training to improve their ability to apply ATT&CK.