In MITRE ATT&CK, a tactic describes the adversary’s tactical objective, such as gaining initial access, executing code, collecting data, or causing impact. Tactics help defenders understand why a technique is being used and how it fits into an intrusion sequence.
How this term helps security teams
Glexia uses tactics to organize executive risk narratives and SOC coverage reviews around attacker objectives rather than isolated alert names.
Where practitioners use this concept
- Board-level attack path explanations
- SOC coverage heatmaps
- Detection engineering backlog planning
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.