Phase 0: Security Fundamentals for AI · 50 min · Python · MITRE ATLAS
MITRE ATLAS — The Attack Taxonomy for AI Systems
ATT&CK gave defenders a shared language for enterprise intrusions. ATLAS does the same for AI.
Hiring signal: Fluency in MITRE ATLAS vocabulary is now a baseline expectation on AI red team and AI security job postings — it's the shared language red and blue teams use to describe a finding precisely instead of re-explaining the attack from scratch in every report.
What you will learn
- Explain the ATLAS matrix structure: tactics, techniques, and sub-techniques, and how it mirrors MITRE ATT&CK
- Walk the AI-specific kill chain from reconnaissance through impact
- Map a real incident (EchoLeak) to specific ATLAS tactics and techniques
- Use ATLAS as a shared vocabulary to communicate findings between red and blue teams
The Problem
Before 2021, if a red team found that an image classifier could be fooled by a perturbed input, or that a chatbot leaked its system prompt, they wrote it up in whatever vocabulary felt natural. One report called it "input manipulation." Another called it "model confusion." A third called it "prompt leakage." None of these terms meant the same thing to the next team that read the report, and none of them connected to the enterprise security vocabulary that the rest of the security organization already used — MITRE ATT&CK.
MITRE, working with partners including Microsoft, NVIDIA, and Bosch, published ATLAS (Adversarial Threat Landscape for Artificial-Intelligence Systems) to fix exactly this. ATLAS is structured like ATT&CK — tactics (the attacker's goal at a given stage), techniques (how they achieve it), and sub-techniques (specific variants) — but every entry is grounded in a real, observed ML or LLM attack, not a hypothetical.
The payoff shows up the moment two teams need to talk about the same finding. When a red team writes "AML.T0051 — LLM Prompt Injection" in a report, a blue team engineer can look that exact technique up on atlas.mitre.org, see other real-world case studies of it, and immediately understand the attack family without a meeting. That shared vocabulary is the entire value proposition — the same reason ATT&CK became load-bearing infrastructure for enterprise security a decade earlier.
The ATLAS Matrix Structure
ATLAS mirrors ATT&CK's three-level structure:
- Tactics — the attacker's objective at a given stage (e.g. "Exfiltration," "Initial Access"). There are roughly a dozen, ordered to loosely follow a kill chain.
- Techniques — the specific method used to achieve a tactic (e.g. "LLM Prompt Injection" under Execution).
- Sub-techniques — variants of a technique (e.g. prompt injection has direct and indirect sub-variants).
Unlike ATT&CK, which assumes a fixed enterprise IT environment, ATLAS adds ML-specific tactics that don't exist in traditional intrusion kill chains — most notably ML Model Access (how much query/access an attacker has to the model itself) and ML Attack Staging (preparing an attack payload, like crafting an adversarial example, before deploying it).
The matrix is a living document — MITRE adds and occasionally renumbers techniques as new attack classes are discovered. Treat the exact IDs in any write-up (including this lesson's code) as a snapshot; always confirm the current ID at atlas.mitre.org before citing one in a real report.
Unlock the full lesson
You've read the first 2 sections. The rest of this lesson covers Walking the Kill Chain: Reconnaissance to Impact, Mapping EchoLeak to ATLAS, ATLAS as a Shared Vocabulary Between Red and Blue Teams, Build It, What to Practice — plus a hands-on lab, quiz, and project artifact.
Create a free account to unlock Phase 0 and Phase 1 of every course — no credit card.
Browse all courses · View pricing · DeVenture Academy