MITRE ATLAS is MITRE's public knowledge base of how adversaries attack AI systems, and it changes every month. Its September 2026 release, 2026.09, holds 16 tactics, 120 techniques with 88 sub-techniques, 40 mitigations and 73 case studies, and it labels each technique by how much evidence there is that attackers use it. ISACA's AAISM outline names no catalog, ATLAS included, but it asks a security manager to identify and assess the AI threat landscape, which is the ground ATLAS maps. This guide explains what ATLAS is, how its matrix is organized, what its maturity labels and case studies tell you, what changed in the last year, and how it fits with the OWASP list.
The short answer
- What it is: in MITRE's words, "a public knowledge base of adversary TTPs targeting AI systems", the tactics, techniques and procedures attackers use, drawn from real attacks and red-team demonstrations.
- What is in it: release 2026.09 has 16 tactics, 120 techniques, 88 sub-techniques, 40 mitigations and 73 case studies.
- How it relates to ATT&CK: 14 of its 16 tactics carry a reference to MITRE ATT&CK. The other two, AI Model Access and AI Attack Adaptation, are specific to AI.
- What is new: maturity labels since September 2025, platforms on every technique since May 2026, and fast growth, much of it in attacks by and on AI agents.
- For the AAISM: use it to name and prioritize threats, not to memorize IDs.
Is MITRE ATLAS on the AAISM exam?
Not by name. ISACA's exam content outline names no framework or catalog. What it names is the work: topic 2B, AI Threat and Vulnerability Management, and tasks such as "Identify and assess the AI threat landscape" and "Design and implement testing and vulnerability management of AI solutions". Another task asks for processes to investigate, document and report AI security incidents, and a shared name for what an attacker did helps there too.
ISACA's guide says its questions are "developed with the intent of measuring practical knowledge and the application of general concepts and standards". Expect scenarios about threats, testing and incidents, not technique IDs. ATLAS is a current, public map of those threats.
What MITRE ATLAS is
ATLAS stands for Adversarial Threat Landscape for AI Systems. MITRE's own description, from its August 2026 release notes: "ATLAS is a globally accessible, living knowledge base of adversary tactics and techniques involving AI, including attacks against AI-enabled systems, abuse or manipulation of AI capabilities, and harmful autonomous behavior materially enabled by AI." It is "based on empirical evidence from observations of real-world attacks as well as realistic demonstrations from AI red teams and security groups."
Three facts help when you meet it at work:
- It is data, not a document. MITRE distributes ATLAS as a dataset in its atlas-data repository on GitHub, under the Apache 2.0 license, and the release you read is a numbered file.
- It changes monthly. In MITRE's words, "ATLAS releases monthly content updates." Since May 2026, content versions are named by year and month, such as 2026.09, separately from the version of the data format, 6.0.0.
- It mirrors ATT&CK where it can. Of the 16 tactics, 14 reference an ATT&CK tactic, and 44 techniques reference ATT&CK techniques (our count from the data). That makes ATLAS readable to a security operations team that already uses ATT&CK.
The ATLAS matrix: 16 tactics
A tactic is the adversary's goal at a stage of an attack; techniques are how the adversary reaches it. The 2026.09 matrix orders the tactics like this:
| # | Tactic | Origin |
|---|---|---|
| 1 | Reconnaissance | ATT&CK |
| 2 | Resource Development | ATT&CK |
| 3 | AI Attack Adaptation | AI-specific |
| 4 | Initial Access | ATT&CK |
| 5 | AI Model Access | AI-specific |
| 6 | Execution | ATT&CK |
| 7 | Persistence | ATT&CK |
| 8 | Privilege Escalation | ATT&CK |
| 9 | Defense Evasion | ATT&CK |
| 10 | Credential Access | ATT&CK |
| 11 | Discovery | ATT&CK |
| 12 | Lateral Movement | ATT&CK |
| 13 | Collection | ATT&CK |
| 14 | Command and Control | ATT&CK |
| 15 | Exfiltration | ATT&CK |
| 16 | Impact | ATT&CK |
The two AI-specific tactics are where ATLAS differs most from ATT&CK. AI Model Access is the stage where "The adversary is attempting to gain some level of access to an AI model", anything from full knowledge of its internals to access to the physical environment where its data is collected. AI Attack Adaptation, called AI Attack Staging until August 2026, is where "The adversary is adapting capabilities, methods, knowledge, or objectives into attack-ready outputs for a target or current operational conditions."
Techniques and their maturity
Under the tactics sit 120 techniques and 88 sub-techniques, each with an ID: AML.T0051 is LLM Prompt Injection, and AML.T0051.001 its indirect form. Descriptions are written as adversary behavior. LLM Prompt Injection begins: "An adversary may craft malicious prompts as inputs to an LLM that cause the LLM to act in unintended ways."
Since version 5.0.0 in September 2025, each technique carries a maturity label, which MITRE defines as "the level of evidence behind the technique's use":
- Feasible: "The technique has been shown to work in a research or academic setting".
- Demonstrated: "The technique has been shown to be effective in a red team exercise or demonstration on a realistic AI-enabled system".
- Realized: "The technique has been used by a threat actor in a real-world incident targeting an AI-enabled system".
In 2026.09, 101 of the 208 techniques and sub-techniques are realized, 83 demonstrated and 24 feasible (our count). Every technique also names the platforms it applies to: predictive AI, generative AI, agentic AI or enterprise systems. Agentic AI is tagged on 139 of them, more than any other platform. Some techniques a security manager will meet often:
| ID | Technique | Maturity |
|---|---|---|
| AML.T0051 | LLM Prompt Injection | Realized |
| AML.T0054 | LLM Jailbreak | Realized |
| AML.T0010 | AI Supply Chain Compromise | Realized |
| AML.T0020 | Training Data Poisoning | Realized |
| AML.T0024 | Exfiltration via AI Inference API | Realized |
| AML.T0070 | RAG Poisoning | Demonstrated |
| AML.T0053 | AI Agent Tool Invocation | Demonstrated |
| AML.T0029 | Denial of AI Service | Demonstrated |
| AML.T0034 | Cost Harvesting | Feasible |
A feasible label means the evidence so far comes from research, not that the technique is harmless. Cost Harvesting, labeled feasible, describes driving "a victim's AI services beyond normal operating capacity with the intent of increasing the cost of services".
Mitigations
ATLAS's 40 mitigations are grouped as policy, technical AI or technical cyber controls. Each is tied to phases of the AI life cycle, from business and data understanding to monitoring and maintenance, and linked to the techniques it addresses. Counting those links in 2026.09 shows which controls reach furthest (our count, techniques and sub-techniques together):
| Mitigation | Category | Techniques |
|---|---|---|
| AML.M0035 AI Red Team | All three | 33 |
| AML.M0020 Generative AI Guardrails | Technical, AI | 23 |
| AML.M0005 Control Access to AI Models and Data at Rest | Policy | 20 |
| AML.M0019 Control Access to AI Models and Data in Production | Policy | 20 |
| AML.M0024 AI Telemetry Logging | Technical, cyber | 18 |
| AML.M0004 Limit AI Service Query Volume and Rate | Technical, cyber | 16 |
| AML.M0000 Limit Public Release of Information | Policy | 15 |
| AML.M0039 AI Honeypots | Technical, AI and cyber | 15 |
The top of that table reads like a program budget: red teaming, guardrails, access control, logging and rate limits are broad controls a security program can fund and measure. The newest, AI Honeypots, added in 2026.09, are decoys that "serve no real business or operational functions", so "any interaction with them is a high-confidence indicator of unauthorized activity".
Case studies
The 73 case studies tell attacks step by step, each step tied to a tactic and a technique. MITRE labels each one an incident or an exercise: in 2026.09 there are 23 incidents and 50 exercises (our count). The newest incidents show where attacks are heading: autonomous agents in a cyber evaluation that crossed its boundaries and compromised a platform's production systems, a multi-agent framework turned against government systems, campaigns to copy a commercial model's capabilities by training on its outputs, and promotional recommendations planted in AI assistants' memory through crafted links. The supply chain is there too, from malicious models carrying malware on a public model hub to a look-alike MCP server package that turned malicious once it was popular and exfiltrated its users' email.
For a manager, case studies may be the most usable part of ATLAS: each one is a ready-made scenario for a tabletop exercise or a test plan, and its steps show which controls would have broken the chain.
What changed since 2025
- April 2025 (4.9.0): "The language in TTP names and descriptions has been updated to consistently prefer AI / artificial intelligence over ML / machine learning."
- September 2025 (5.0.0): the maturity labels.
- May 2026 (2026.05): content and format versions split, and every technique tagged with its platforms.
- August 2026 (2026.08): AI Attack Staging renamed AI Attack Adaptation, techniques for autonomous attacks such as Autonomous Reconnaissance and Autonomous Attack Orchestration, and mitigations against agents expanding their authority or drifting from their scope.
- September 2026 (2026.09): six new techniques, five new sub-techniques and AI Honeypots.
The growth is steep, and mostly agentic: of the 70 techniques and sub-techniques created since MITRE's November 2025 release, 48 apply to agentic AI (our count). MITRE's release notes count 84 techniques, 56 sub-techniques, 32 mitigations and 42 case studies in November 2025, against 120, 88, 40 and 73 in September 2026. The practical lesson: name the release you used. OWASP's 2026 appendix, mapped to ATLAS content v2026.06, still calls AML.TA0001 AI Attack Staging; two releases later it had a new name.
ATLAS and the OWASP LLM Top 10
The two are often named together, and they answer different questions. The OWASP list ranks risks in applications built on language models; ATLAS describes adversary behavior across predictive, generative and agentic AI and the enterprise systems around them. OWASP's 2026 edition connects them. Its appendix maps each entry to "the MITRE ATLAS adversary tactics (AML.TAxxxx) an attack exploiting it traverses", and its entries cite ATLAS techniques directly, such as AML.T0010 for supply chain and AML.T0070, RAG Poisoning, for retrieval-time poisoning. Our guide to the OWASP LLM Top 10 2026 covers the list.
Putting ATLAS to work as a security manager
Five uses we suggest:
- Threat modeling. Use ATLAS as the adversary lens next to STRIDE and the OWASP list: for each trust boundary, ask which techniques reach it.
- Threat intelligence. Read each month's new case studies against your AI inventory, and ask which involve platforms, models or tools you run.
- Testing. Choose test cases by technique, platform and maturity, and report findings by ATLAS ID, with the release, so they can be tracked over time.
- Incident response. Classify what an attacker did with ATLAS tactics and techniques, so incident reports and the threat model use the same names.
- Control coverage. Use the mitigation links to see which techniques your controls address and which they leave open.
How ATLAS meets the AAISM outline
ISACA's outline does not mention ATLAS, so this mapping is ours:
| AAISM topic | ATLAS part | Use |
|---|---|---|
| 2B AI Threat and Vulnerability Management | Tactics, techniques, maturity | Naming threats and choosing tests |
| 1E Business Continuity and Incident Response | Case studies, techniques | Classifying and learning from incidents |
| 2C AI Vendor and Supply Chain Management | Supply-chain techniques and incidents | Third-party models, tools and data |
| 3A AI Security Architecture and Design | Techniques by platform | The adversary lens in threat modeling |
| 3E Security Controls and Monitoring | Mitigations, telemetry logging, honeypots | Control coverage and detection |
Learning ATLAS with QualExam
Our AAISM course teaches ATLAS in nine lessons. Lesson 2B/01, on the AI threat landscape, explains what ATLAS is and how it relates to ATT&CK; the threat-modeling lesson, 3A/01, uses it as the adversary lens; and the threat-intelligence lesson, 2B/06, reads its case studies as intelligence. Lesson 1A/01 introduces it in the first topic, AI governance and regulation, which opens in full with a free account. Full access is a single payment, with nothing to renew. For the companion frameworks, see the NIST AI RMF for AAISM candidates.
By QualExam editorial. Written against the certifying body’s published documents, pinned by hash so a revised edition shows up as a change.