What is MITRE D3FEND?
MITRE D3FEND is a freely available knowledge graph of cyber defence techniques that describes which measures defenders can take, which digital and physical objects those measures act on, and which attack techniques from MITRE ATT&CK they help against. Where ATT&CK captures attacker behaviour, D3FEND gives defenders a shared, precise vocabulary for protection, detection, isolation and recovery. Since December 2025 there has also been an extension for OT, with techniques for controllers, sensors, actuators and engineering workstations.
D3FEND turns “we have a firewall and a SIEM” into a testable statement: which defensive technique, on which object, against which attacker behaviour?
🧠 Where does D3FEND come from?
D3FEND was developed by the National Security Engineering Center (NSEC), a research centre that MITRE operates for the US government. The research is funded by the NSA’s Cybersecurity Directorate, later joined by funding from the US Department of Defense. The model was built from research literature and from more than 500 patents on cyber security countermeasures filed between 2001 and 2018. This captures how security products actually work, independent of marketing language.
| Milestone | Date | What changed |
|---|---|---|
| Beta | June 2021 | First public version with five tactics: Harden, Detect, Isolate, Deceive and Evict |
| Further development | 2021–2025 | Model and Restore tactics added; the knowledge graph grew to roughly three times its original size |
| D3FEND 1.0 | 16 January 2025 | Stable ontology in OWL 2 DL, the Cyber Attack-Defense (CAD) tool, integration with CWE and content on identity, access and OT |
| D3FEND for OT | 16 December 2025 | OT-specific objects, events and countermeasures, plus a link to MITRE ATT&CK for ICS |
D3FEND is neither a standard nor a product. It is an ontology: a formal model in which concepts and their relationships are captured in machine-readable form, so that tools and analysts can draw conclusions from it automatically. Since version 1.0, D3FEND has been considered stable and receives planned, predictable updates; as of October 2026 the knowledge graph is at version 1.6.
🔧 How is MITRE D3FEND structured?
The core of D3FEND consists of three layers:
- Tactics - the defender’s goal, such as hardening or detecting
- Techniques - the concrete defensive method, each with an ID such as D3-MFA (Multi-factor Authentication) or D3-NI (Network Isolation)
- Digital artifacts - the objects a technique acts on, such as a process, file, user account, network traffic or a PLC program
The matrix now has seven tactics:
| Tactic | Defender’s goal | Example D3FEND techniques | Typical implementation |
|---|---|---|---|
| Model | Know what you are defending | Asset Inventory, Network Mapping, Operational Dependency Mapping | Asset inventory, network diagrams |
| Harden | Reduce the attack surface | Multi-factor Authentication, Change Default Password, Software Update | MFA, Least Privilege, RBAC, Hardening |
| Detect | Spot unwanted activity | Network Traffic Analysis, File Integrity Monitoring, User Behavior Analysis | SIEM, EDR, anomaly detection |
| Isolate | Limit an attacker’s freedom of movement | Network Isolation, Executable Allowlisting, Directional Network Link | Firewall, VLAN, microsegmentation, allowlisting |
| Deceive | Mislead attackers | Decoy Environment, Decoy File, Decoy User Credential | Honeypots, decoy accounts |
| Evict | Remove the attacker | Credential Revocation, Process Termination, File Eviction | Incident response, SOAR playbooks |
| Restore | Return to normal operation | Restore Configuration, Restore Disk Image, Restore Software | Backups, reinstallation |
Note the difference between the third and fourth columns. A SIEM is not a D3FEND technique but a product that can perform several techniques. That separation is exactly what lets you compare products on substance.
🔄 How does D3FEND link defence to ATT&CK?
D3FEND does not link defensive and offensive techniques through a hand-made list, but through digital artifacts. An attack technique acts on an object, and so does a defensive technique. When they act on the same or a related object, the ontology infers a relationship.
An example: Multi-factor Authentication (D3-MFA) strengthens a user account and uses a credential. Attack techniques that target those objects, such as Password Guessing (T1110.001), Password Spraying (T1110.003) and abuse of domain accounts (T1078.002), therefore appear as related. D3FEND itself labels these inferred mappings as experimental. They show relationships, but say nothing about how effective a measure is.
| Characteristic | MITRE ATT&CK | MITRE D3FEND |
|---|---|---|
| Perspective | Attacker | Defender |
| Basis | Observed attacks and threat reports | Patents, research literature, technical behaviour |
| Structure | Tactics, techniques, procedures (TTPs) | Tactics, techniques, digital artifacts |
| Format | Matrix and STIX data | Ontology (OWL 2 DL) and knowledge graph |
| OT variant | ATT&CK for ICS | D3FEND for OT (since December 2025) |
| Typical use | Detection rules, red teaming, threat analysis | Choosing controls, gap analysis, comparing products |
ATT&CK has its own mitigations (M numbers), but they are broadly worded, such as “Multi-factor Authentication” or “Network Segmentation”. D3FEND goes one level deeper and describes what a measure does technically.
🏭 What does D3FEND for OT add?
Until the end of 2025, D3FEND was mainly IT-oriented. D3FEND for OT builds on the core and adds objects such as OT controllers, I/O modules, sensors, actuators, the HMI application, the engineering workstation, the process data historian, the mode switch and the physical data diode. It also models 45 types of OT protocol messages and 45 types of OT events, and adds 17 new OT countermeasures.
A few OT countermeasures show how concrete the model is:
| Technique | ID | What it means | OT example |
|---|---|---|---|
| Operating Mode Restriction | D3-OPR | Prevent unauthorised changes of operating mode | PLC key switch in Run or Remote, key removed and under key management |
| OT Variable Access Restriction | D3-OVAR | Set read/write rights per register or tag | Expose a value over Modbus as an input register, or write-protect a data block in a Siemens PLC |
| Directional Network Link | D3-DNL | Enforce one-way communication | Data diode between a safety system and the office network |
| Remote Firmware Update Monitoring | D3-RFUM | Monitor remote firmware updates | Alert on an unexpected firmware download to a controller |
| Hardware-based Write Protection | D3-HBWP | Physically block writes | Write-protect switch on a module |
D3FEND for OT also contains worked example models of well-known incidents, such as TRITON, Industroyer, BlackEnergy, NotPetya, Colonial Pipeline and the attacks on Unitronics PLCs at water utilities, plus a simple and a detailed representation of the Purdue Model. MITRE explicitly states that D3FEND for OT is not a complete OT model, not a compliance checklist and not a replacement for OT standards. Notably, many OT techniques do not yet have inferred ATT&CK mappings.
🧭 How do you use D3FEND in practice?
An approach that works well in a production environment:
- Model your installation - start with the Model tactic: asset inventory, network map and dependencies. Without that overview, every mapping remains theoretical.
- Choose relevant attack techniques - select from MITRE ATT&CK for ICS and ATT&CK Enterprise the techniques that match your threat landscape, for example from sector threat intelligence or from CISA advisories, which often already include ATT&CK IDs.
- Find the matching defence - for each attack technique, see which D3FEND techniques act on the same artifacts.
- Map your existing controls - translate products such as EDR, SIEM, firewalls and network segmentation into the D3FEND techniques they actually perform.
- Identify the gaps - where is a layer missing in your defence in depth? Prioritise by process impact, not by count.
- Visualise and communicate - the CAD tool lets you draw and share attack and defence graphs, useful in a purple team exercise or when designing SOC use cases and threat hunting.
Link the outcome to the requirements you already have. In IEC 62443, the system requirements are in IEC 62443-3-3; D3FEND helps show which technical measure fulfils which requirement. For Dutch organisations under NIS2 and the Cybersecurity Act, which entered into force on 15 August 2026, such a gap analysis provides evidence for the duty of care and for conversations with auditors about compliance.
🔐 What are the limitations of D3FEND?
- No effectiveness score - according to MITRE, D3FEND does not prescribe countermeasures, prioritise them or assess their effectiveness. Testing remains necessary.
- Experimental mappings - the inferred relationships with ATT&CK are reasoned automatically and can be too broad or too narrow.
- IT emphasis - even after the OT extension, most techniques are IT-focused. Complement it with the ICS mitigations in ATT&CK, NIST SP 800-82 from NIST and IEC 62443.
- Learning curve - the ontology approach is powerful but abstract. Start with one scenario rather than the whole matrix.
- Prioritisation is up to you - which measure comes first depends on your architecture, risks and process safety.
❓ Frequently asked questions
What does D3FEND stand for?
D3FEND stands for Detection, Denial, and Disruption Framework Empowering Network Defense. In practice, almost everyone simply uses the name MITRE D3FEND. It is the defensive counterpart of MITRE ATT&CK.
Is MITRE D3FEND free to use?
MITRE D3FEND can be consulted online free of charge and the knowledge graph can be downloaded for use in your own tools. Use is subject to MITRE’s terms of use. No licence or certification is required to apply D3FEND.
What is the difference between MITRE D3FEND and MITRE ATT&CK?
MITRE ATT&CK describes what attackers do, based on observed attacks. MITRE D3FEND describes what defenders can do technically and links those defensive techniques to ATT&CK techniques through digital artifacts. Together they give a picture of both attack and defence.
Is MITRE D3FEND suitable for OT environments?
Since December 2025, MITRE D3FEND has had an OT extension with techniques such as Operating Mode Restriction, OT Variable Access Restriction and Directional Network Link. This brings PLCs, HMIs, historians and data diodes into the model. For full OT coverage, combine D3FEND with ATT&CK for ICS and IEC 62443.
Can D3FEND prove that I comply with NIS2?
MITRE D3FEND is not a compliance framework and contains no legal requirements. A D3FEND gap analysis does, however, help substantiate which technical measures you have taken against which threats. That is useful evidence for the duty of care under NIS2 and the Dutch Cybersecurity Act.
What is the D3FEND CAD tool?
The D3FEND CAD tool (Cyber Attack-Defense) is an online canvas on which you connect attack techniques, artifacts and defensive techniques as nodes. The tool uses the reasoning built into the D3FEND ontology and became available with D3FEND 1.0 in January 2025. You can share the graphs over the internet or within a private network.
📌 In summary
MITRE D3FEND is the defensive counterpart of ATT&CK: a knowledge graph with seven tactics (Model, Harden, Detect, Isolate, Deceive, Evict, Restore) that links defensive techniques to attack techniques through digital artifacts. With version 1.0 from January 2025 and the OT extension from December 2025, D3FEND helps you name controls precisely, find gaps in your defences and compare products on substance, including for PLCs, HMIs and data diodes in your OT security landscape.