Center for Threat-Informed Defense

Changing the Game on the Adversary

The Center is a non-profit research and development consortium operated by MITRE. The Center’s mission is to advance the state of the art and the state of the practice in threat-informed defense globally. Comprised of participant organizations from around the globe with highly sophisticated security teams, the Center builds on MITRE ATT&CK®, an important foundation for threat-informed defense used by security teams and vendors in their enterprise security operations.

The results of our research & development projects are freely available to the public.

Just Released

Attack Flow

Attack Flow helps defenders capture the entire scope of a cyber attack and communicate what matters. By representing actions, conditions, and relationships as a connected flow, teams can move from isolated observations to a shared view of how an event unfolded.

The latest project release helps defenders create and enrich flows more quickly with automated layout, LLM-assisted flow generation, Technique Inference Engine recommendations, tags, TLP markings, mitigation and detection support, and new visualizations. Attack Flow also supports additional TTP frameworks, including MITRE ATLAS™, MITRE D3FEND™, and the MITRE Fight Fraud Framework™, so teams can add the context needed to prioritize detection, patching, remediation, and communication.

Newest Resource

2025 Impact Report

2025 was a pivotal year for the MITRE Center for Threat-Informed Defense, strengthening the resolve of our membership, and reinforcing that, with our threat-informed defense community, we are greater together. With the explosion of artificial intelligence, our research program is more consequential than ever and our members are responding to the call for greater innovation and are testing the limits of our stretch goals.

Featured Resource

MITRE INFORM: Best Practices Assessment Tool

MITRE INFORM identifies technical components for each of the 3 Dimensions of TID. For each component, a spectrum of maturity levels are defined from the least threat-informed to a most threat-informed implementation. The INFORM assessment allows you to evaluate your level of threat-informed defense so you can make decisions on existing or planned defensive measures and identify any gaps you might have.