Threat-Informed Defense

Threat-Informed Defense aligns security strategy and measures with the real technical behavior of the adversaries who actually threaten an organization. The approach answers three questions: Who is attacking us, and how? What do we do to protect ourselves against it? And how do we know that our measures really work?

German companies spend more on IT security year after year, and yet they are hit more often, with ever higher losses. According to the Bitkom study Wirtschaftsschutz 2025, data theft, espionage and sabotage caused total damage of €289.2 billion to the German economy within one year; €202.4 billion of that, around 70 percent, was due to cyberattacks. Ransomware caused damage at 34 percent of companies and remains the most dangerous single threat.

The Bundeslagebild Cybercrime 2025 of the German Federal Criminal Police Office (BKA) confirms the trend: 1,041 ransomware attacks were reported to the police, ten percent more than in the previous year, with a considerably larger number of unreported cases. Cyber operations also play a growing role in hybrid warfare, aimed at destabilizing social and economic structures.

The conclusion is uncomfortable: rising investment does not automatically lead to more resilience. Anyone who does not align their security program with the actual technical behavior of the adversaries who threaten them is spreading their budget with a watering can, and leaves open exactly the gaps that adversaries actually exploit.

Threat-Informed Defense aligns security strategy and measures with the real technical behavior of the adversaries who actually threaten an organization. The approach answers three questions: Who is attacking us, and how? What do we do to protect ourselves against it? And how do we know that our measures really work?

Threat-Informed Defense is neither a product nor a project but a continuous cycle of three phases: Cyber Threat Intelligence answers who is attacking the organization and how. Defensive Measures aligns protective and detection measures specifically against exactly these techniques. Testing & Evaluation proves that the measures really work, and feeds the findings back into the next iteration.

The approach is driven by the international cybersecurity community, above all by the MITRE Corporation and the Center for Threat-Informed Defense, whose founding members include Microsoft, Amazon Web Services and IBM alongside MITRE. The Center pools research and freely available tools, from the M3TID project (Measure, Maximize, and Mature Threat-Informed Defense), whose three dimensions correspond exactly to these phases, to the Adversary Emulation Library for realistic attack simulations.

Why does Threat-Informed Defense focus on behaviors rather than classic indicators? Adversaries continuously adapt their methods to remain undetected for as long as possible. Changing indicators such as IP addresses, domains and file hash values is easy for them. Their fundamental technical goals and behaviors, the so-called Tactics, Techniques and Procedures (TTPs), on the other hand, are very hard to disguise.

This asymmetry is exactly what security researcher David J. Bianco’s Pyramid of Pain illustrates: it ranks attack indicators by how much effort and pain it costs adversaries to change or disguise them once defenders target them. A file hash changes with every recompilation, and IP addresses and domains are replaced in minutes; anyone who bases their defense mainly on these plays a game of cat and mouse that the adversary always wins. Anyone who takes away the adversary’s TTPs, by contrast, forces them to reinvent their approach: that is expensive, slow and error-prone. TTPs are therefore the means of choice to understand adversaries and protect against them effectively, and Threat-Informed Defense starts at the top of the pyramid.

Capturing TTPs systematically requires a common language. The MITRE ATT&CK framework structures knowledge about adversary behavior from attacks observed in the real world:

Tactic

The adversary’s goal in a phase of the attack, such as gaining initial access, evading defenses or encrypting data.

Technique

The technical method used to achieve this goal, such as exploiting a public-facing application.

Sub-technique

A more specific variant of a technique, such as deliberately disabling security tools.

Procedure

The concrete implementation: how and in what order a specific adversary actually uses techniques.

In the current version 18 (October 2025), the Enterprise matrix comprises 14 tactics with 216 techniques and 475 sub-techniques. New since v18: instead of simple detection notes, the framework provides structured Detection Strategies with more than 1,700 concrete analytics, a considerable practical gain for building effective detection.

The ATT&CK Navigator visualizes these TTPs as a table: each tactic corresponds to a column, techniques and sub-techniques to the rows below it. Following the typical course of a cyberattack (see the Cyber Kill Chain), the tactics are arranged chronologically. This makes it visible which techniques are relevant to your own threat landscape and where your own coverage stands.

The framework is maintained by a worldwide community around MITRE and the Center for Threat-Informed Defense, from corporations such as Microsoft and Amazon Web Services through international and national cybersecurity authorities such as Germany’s BSI to smaller companies and individuals. They share analyses of real cyberattacks and ensure that ATT&CK is continuously expanded and, in addition to categorizing TTPs, offers concrete supplementary information.

How the cycle works in practice is shown by a threat scenario that affects virtually every organization: ransomware. The BKA’s Bundeslagebild Cybercrime 2025 counts around 100 different ransomware families targeting German organizations; the most active were Akira, SafePay, INC/Lynx, LockBit and Qilin. 292 German victims were publicly extorted on leak sites, 88 percent more than in the previous year. Although only 7 percent of those affected still paid a ransom, the average payment rose by 65 percent to the equivalent of around $456,000.

Phase I (Cyber Threat Intelligence): who is attacking us, and how? For Akira, the most active group in Germany, the joint advisory by the FBI, CISA, Europol and German security authorities (AA24-109A, updated in November 2025) provides the TTPs from real investigations, mapped to ATT&CK v18. By the end of September 2025, the group had extorted around $244 million. Its approach follows a pattern that runs through the entire ransomware landscape:

Projects of the Center for Threat-Informed Defense also help with selecting and prioritizing relevant TTPs: the Sightings Ecosystem has evaluated more than 1.6 million observations of real attacks and identified the most frequently used techniques; with the Top ATT&CK Techniques Calculator, organizations determine the techniques relevant to them from just a few inputs. A proven prioritization scheme: start with the techniques used by as many relevant adversaries as possible.

Phase II (Defensive Measures): what do we do to protect ourselves? For each of these techniques, the ATT&CK framework provides proven countermeasures that can be prioritized directly: multi-factor authentication on all remote access points without exception (T1078/T1133), consistent patching of the vulnerabilities on edge systems that adversaries actively exploit (T1190), tamper protection in endpoint protection and restricted administrator rights (T1562.001), monitored data outflow (T1048) and offline backups that adversaries cannot delete (T1490). Which of these are implemented is decided by the organization based on impact, effort and risk appetite.

How concrete this guidance is can be seen in the technique “Disable or Modify Tools” (T1562.001): against the disabling of security tools, the framework defines two types of proven measures:

Protective measures (mitigations)

Restricting user permissions so that security-relevant tools cannot be disabled or modified; policies that limit access to these tools and monitor their use; regular review of security configurations; endpoint protection with tamper protection.

Detection measures (detections)

Monitoring changes to security-relevant tools and system files; detecting unusual activity that indicates deactivation or tampering; integrity checks of security-relevant files and programs; analysis of logs and events for tampering attempts.

Further guidance comes from the Center projects “Summiting the Pyramid”, detection logic that adversaries cannot easily evade, and “Controls Mapping”, which maps the measures to standards such as NIST 800-53 and ISO 27001, as well as from the Detection Strategies and Analytics available since ATT&CK v18 with concrete detection logic for each technique.

Phase III (Testing & Evaluation): how do we know our measures work? Prove instead of assume, and that does not have to be expensive. A start with on-board resources: knowledgeable administrators check whether the endpoint protection can be terminated in an unplanned way in different user contexts, whether every remote access point really enforces MFA and whether recovery from the offline backup actually works. Organizations with a higher level of maturity test in a structured way: penetration tests or breach and attack simulations along the real attack chain, from Initial Access through Defense Evasion and Exfiltration to Impact. The organizational side should always be tested as well: was the attack attempt detected, reported and handled according to the defined process? The results feed back into Phase I, and the cycle starts over.

By systematically analyzing the behavior of relevant adversaries, Threat-Informed Defense makes it possible to steer investments in cybersecurity with precision. Anyone who continuously monitors and assesses the TTPs of current and potential adversaries can adapt their security strategy dynamically and measurably strengthen their own resilience.

The approach has a low barrier to entry and can also be applied by organizations with a lower level of maturity: the examples shown work regardless of size and budget. Integrated into a comprehensive security concept that also includes awareness and basic hygiene, Threat-Informed Defense resolves the divergence between rising investment and real resilience.