Steps 2 to 5 — threat scope

Crown jewels, threat actors, the techniques most likely to be used against you, and the attack paths that make a technique matter.

What these steps establish

These four steps turn a generic catalogue into your catalogue. Scope is an intersection: a technique must be possible on your platforms, used by adversaries you care about, and sit on a path to something worth taking.

Crown jewels

Name what you are protecting and what kind of asset it is — identity, data store, cloud control plane, source code, backups, endpoint fleet, email or OT. The category matters: it determines which tactics are weighted as high impact for you. Declaring domain controllers lifts credential access and lateral movement; declaring backups lifts the ransomware playbook.

Since model 1.6.0 the asset type is a structured choice of sixteen, each mapped to the category the tool has always used, so an assessment saved with an earlier category ranks, scores and exports exactly as before. A type establishes technical relevance: which tactics an adversary must succeed at to reach it, which ATT&CK platforms it is assessed through, which telemetry families see it, which TIR-CMM asset class it maps to, and which scenario templates apply. It never asserts that an adversary targets the asset; actor suggestions stay based on sector and region. A mobile application is assessed through its backend, API, identity and cloud infrastructure, because this dataset is Enterprise ATT&CK and no native Android or iOS coverage is claimed.

Each declared crown jewel shows what its type changes downstream, and the telemetry step and the roadmap tag every source with the crown jewel it serves. Tactic weights for the new types are on the data model page.

Threat actors

Select the groups and campaigns that plausibly target your sector and geography, from ATT&CK's own actor data. Their combined technique set becomes your candidate pool.

This is where assessments stall. Choosing from 232 documented groups and campaigns with no starting point is the reason scoping gets skipped, and a technique set chosen by tooling rather than by threat is the failure the whole model exists to expose. So the tool offers a suggested threat profile: declare your sector and region on the previous step and it ranks the adversaries ATT&CK documents against organisations like yours, with the reason for each.

What the suggestion cannot tell you

ATT&CK has no structured targeting field. Sector and region are stated only in the prose of each group's description, so the mapping in data/actor_sectors.yaml is extracted from that text and, where the text is truncated or silent, restored by hand from public attribution. Each entry carries its confidence and is open to challenge.

44 of the 232 documented groups and campaigns carry no reliable targeting information and are excluded entirely. Their absence from your profile says nothing about whether they would target you. ATT&CK also documents intrusions that were investigated and published, which over-represents victims with mature incident response — so a short list means the reporting is thin, not that few adversaries care about your sector.

Likely attacks

The model ranks candidates by probability × impact — observed use across 1,057 documented actors, weighted toward the actors you chose, against tactic severity weighted by the crown jewels you declared. Nothing is selected for you.

Attack paths

Mark the techniques that sit on a modelled route to a crown jewel. This is the attack-tree step reduced to its essence, and it is what separates Tier A — the set worth being excellent at — from everything else.

Start the assessment