Resources
The references our analysts work from, made interactive. Free to use, nothing to sign in to.
The Cyber Field Guide
Plain-English explainers on how attacks actually work and how to stop them — written for people who have to do the job, with the commands to go with them.
Browse the Field Guide
From the cyber kill chain and MITRE ATT&CK to ransomware response, OSINT tooling and vendor risk — searchable, and free to read.
Open the Guide- Articles
- 61
- Topics
- 15
MITRE ATT&CK
The industry’s shared language for adversary behavior — what attackers do, step by step, once they are inside.
v19.1 · 12 May 2026
MITRE ATT&CK — Enterprise
The full enterprise matrix: every tactic, technique and sub-technique, searchable and filterable by platform.
- Tactics
- 15
- Techniques
- 697
v19.1 · 12 May 2026
MITRE ATT&CK — Mobile
The mobile matrix, for adversary behavior against Android and iOS devices.
- Tactics
- 12
- Techniques
- 124
The Pyramid of Pain
Not all indicators are worth the same. This is how much it actually hurts an adversary when you take each one away — and why the work that matters sits at the top.
TTPs
Tough!Tactics, techniques and procedures — how the adversary actually operates. Not what they used, but how they think: the way they gain a foothold, move, and take what they came for.
Detect and respond at this level and the adversary has to relearn their trade. They cannot buy their way out of it, and there is no quick substitution. This is where MITRE ATT&CK lives, and it is the only level where a win is durable.
For example
- Spear-phishing an attachment, then living off the land with WMI
- Kerberoasting to escalate, then exfiltrating over a legitimate cloud service