What is MITRE?
MITRE (The MITRE Corporation) is a US not-for-profit organisation that operates research and development centres on behalf of the US government and maintains freely available cybersecurity knowledge bases such as MITRE ATT&CK, MITRE D3FEND and the CVE programme. In the IT and OT world, MITRE is best known as the source of the common language that defenders use to describe attacks, vulnerabilities and countermeasures. Whether you are reading a vulnerability advisory from a PLC vendor, building a SIEM rule or describing an incident, there is a good chance it contains a MITRE identifier.
MITRE does not sell security products. Its knowledge bases are free, vendor-neutral and used by governments, vendors and asset owners worldwide.
🧠 What kind of organisation is MITRE?
MITRE was founded in 1958 in Bedford, Massachusetts, as a spin-off from MIT Lincoln Laboratory. Its first work was on the SAGE air defence system. The name is not an acronym. Headquarters are split between Bedford and McLean, Virginia, and the organisation employs more than 9,000 people.
What sets MITRE apart is that it operates FFRDCs (Federally Funded Research and Development Centers): research centres that run on government funding but have no commercial interests of their own. This allows MITRE to give independent advice and to share knowledge that vendors would not publish. MITRE operates six of them:
| FFRDC | Sponsor | Domain |
|---|---|---|
| National Security Engineering Center | Department of Defense (DoD) | Defence systems; manages D3FEND among others |
| Center for Advanced Aviation System Development | FAA | Air traffic management and aviation |
| Center for Enterprise Modernization | US tax authority (IRS) and other civilian agencies | Modernising government IT |
| Homeland Security Systems Engineering and Development Institute | DHS | Homeland security; manages CWE among others |
| CMS Alliance to Modernize Healthcare | CMS (healthcare) | Healthcare systems |
| National Cybersecurity FFRDC | NIST | Cybersecurity practices, since 2014 |
MITRE is a target itself. In early 2024, attackers exploited two zero-day vulnerabilities in Ivanti Connect Secure VPN appliances to break into NERVE, one of MITRE’s research networks. The enterprise network was not affected, and MITRE published a public analysis that is worth reading for anyone who provides VPN access to an OT environment.
🔧 Which cybersecurity knowledge bases does MITRE maintain?
MITRE started CVE in 1999 and has since built a whole family of knowledge bases, each answering a different question:
| Knowledge base | Since | Question it answers | Relevance for OT |
|---|---|---|---|
| CVE | 1999 | Which known vulnerability is it? | Links vendor advisories to your assets |
| CWE | 2006 | What type of weakness lies behind it? | Helps vendors prevent structural flaws |
| MITRE ATT&CK | 2015 (public) | How do attackers behave? | Enterprise matrix for the IT part of the attack chain |
| MITRE ATT&CK for ICS | January 2020 | How do attackers target control systems? | Techniques such as Alarm Suppression and Modify Parameter |
| MITRE D3FEND | 2021 (beta), 1.0 in January 2025 | Which defence works against which technique? | Includes OT-specific defensive techniques |
| EMB3D | May 2024 | Which threats apply to embedded devices? | Threat model for PLCs, RTUs and IEDs |
| Caldera | open source | How do I emulate an adversary? | Caldera for OT speaks industrial protocols |
| ATLAS | 2020 (as Adversarial ML Threat Matrix) | How are AI systems attacked? | Relevant for industrial AI |
| Engage | 2022 | How do I deceive and delay an adversary? | Basis for deception and honeypots |
MITRE also developed STIX, an exchange language for threat intelligence, together with DHS; its governance moved to the standards body OASIS in 2015.
🔍 How do CVE, ATT&CK and D3FEND work together?
The three best-known knowledge bases complement each other as links in one chain:
- CVE describes a specific vulnerability in a product, for example a flaw in the firmware of a PLC or in SCADA software. MITRE runs the programme and the US CISA funds it. More than 500 CVE Numbering Authorities, including Siemens and Schneider Electric, assign numbers themselves; CISA is the root for vendors of industrial control systems and MITRE is the CNA of last resort. The severity score does not come from CVE but from CVSS, and whether a flaw is actively exploited comes from the KEV catalogue.
- ATT&CK describes what an attacker does, even when no vulnerability is needed. Many OT attacks abuse legitimate functions, such as downloading a program to a PLC or suppressing alarms. Every technique has an ID, such as T0878 for Alarm Suppression.
- D3FEND links defensive techniques to those attack techniques through a formal ontology. The model has seven tactics: Model, Harden, Detect, Isolate, Deceive, Evict and Restore. D3FEND is funded by the NSA.
The result is a line from vulnerability through attacker behaviour to countermeasure. In April 2025 it became clear how dependent the industry is on that chain: the contract between CISA and MITRE for CVE was about to lapse and was extended by eleven months at the last minute. In early 2026 CISA announced that the programme’s funding had been secured.
🏭 How do you use MITRE knowledge bases in an OT environment?
A practical approach for a manufacturer, water authority or energy company:
- Know your assets - record the vendor and firmware version of every PLC, HMI, RTU and engineering workstation in an asset inventory. Without a version there is no CVE match.
- Match vulnerabilities - compare the inventory with CVE records, CISA ICS advisories and the KEV catalogue, and feed the result into vulnerability management and patch management.
- Select relevant threats - use the groups in ATT&CK for ICS, such as the actors behind TRITON and Industroyer, to decide which techniques are realistic for your sector. This is the basis for threat modelling.
- Measure your detection coverage - map your SIEM rules, OT IDS detections and security monitoring against the matrix. Colour each technique as detected, partially detected or not visible.
- Choose countermeasures with D3FEND - look up defensive techniques for the gaps, such as network isolation or restricting write access to OT variables, and build them into your defence-in-depth architecture.
- Test and exercise - have a red team or purple team emulate techniques, preferably on a test bench. Caldera for OT includes plugins for Modbus, DNP3, BACnet, PROFINET DCP and IEC 61850 MMS.
- Record incidents in ATT&CK terms - so that your SOC, your incident response team and external parties such as the NCSC speak the same language.
For vendors of industrial equipment, EMB3D is particularly interesting. The model maps device properties (hardware, system software such as firmware, application software and networking) to threats and offers mitigations at three levels: foundational, intermediate and leading. This fits well with the component requirements of IEC 62443-4-2 and with the Cyber Resilience Act.
🔐 How do MITRE frameworks relate to standards and legislation?
MITRE knowledge bases are neither a standard nor a legal obligation. IEC 62443, NIST CSF and NIS2 describe which measures you should take; MITRE shows what those measures protect against and how attackers operate. That makes the combination powerful:
| Framework | Role | Where MITRE helps |
|---|---|---|
| IEC 62443 | Requirements for zones, conduits and components | Justifying the required Security Level on the basis of realistic attack techniques |
| NIS2 / Cybersecurity Act | Duty of care and incident reporting | Substantiating the risk analysis and describing incidents unambiguously |
| Cyber Resilience Act | Requirements for products with digital elements | CVE and CWE for vulnerability handling and reporting by manufacturers |
| NIST CSF | Functions from Govern to Recover | Testing measures per function against attack techniques |
In the Netherlands, the Cyberbeveiligingswet (Cybersecurity Act) has been in force since 15 August 2026. An ATT&CK-based threat analysis and a CVE-driven vulnerability process are a good way to demonstrate that your measures are appropriate.
Blue teams, threat hunters and vendors of EDR, XDR and SOAR also use MITRE as a reference. In a zero trust approach, the lateral movement techniques help you decide which connections must be explicitly allowed. Stay critical, though: a vendor claiming “full ATT&CK coverage” says little about the quality of detection in your own OT network.
❓ Frequently asked questions
Is MITRE a government agency?
No, MITRE is an independent US not-for-profit organisation. It works largely on behalf of the US government and operates six government-funded research centres (FFRDCs), but it sells no products and has no commercial interests.
Are MITRE’s knowledge bases free to use?
Yes, ATT&CK, ATT&CK for ICS, D3FEND, CVE, CWE and EMB3D are freely available and may also be used in commercial products. Terms of use do apply, such as attributing MITRE when you reproduce the content.
What is the difference between MITRE ATT&CK and MITRE D3FEND?
MITRE ATT&CK describes attacker behaviour as tactics and techniques, such as Alarm Suppression or Modify Parameter. MITRE D3FEND describes the defensive techniques against them, organised into seven tactics from Model to Restore. Together they show which countermeasure helps against which attack technique.
Does MITRE manage the CVE database?
MITRE has run the CVE programme since its launch in 1999, funded by the US CISA. However, most CVE numbers are assigned by more than 500 CVE Numbering Authorities, such as vendors, and the additional scores in the National Vulnerability Database come from NIST, not from MITRE.
Which MITRE framework matters most for OT?
For OT, MITRE ATT&CK for ICS is the most important framework, because it describes techniques aimed specifically at control systems and the physical process. Since OT attacks often start in the office network, you use the Enterprise matrix alongside it. EMB3D is mainly useful for vendors of embedded devices.
Do I need MITRE ATT&CK to comply with NIS2?
No, NIS2 and the Dutch Cybersecurity Act do not prescribe a specific framework. MITRE ATT&CK is, however, a widely used tool for substantiating a risk analysis, measuring detection and describing incidents unambiguously to the NCSC or a sector CSIRT.
📌 In summary
MITRE is the independent US not-for-profit behind the common language of cybersecurity: CVE for vulnerabilities, ATT&CK for attacker behaviour and D3FEND for defence.
For OT environments, ATT&CK for ICS, CVE, D3FEND and EMB3D are the most valuable. Use them alongside standards such as IEC 62443 and legislation such as NIS2: the standards tell you what to do, MITRE shows you what you are protecting against.