TTP stands for tactics, techniques, and procedures. In ATT&CK-aligned work, it connects the adversary objective, the behavior used to achieve it, and the concrete implementation observed in an environment or report.
How this term helps security teams
Glexia uses TTP language carefully: ATT&CK can support behavior context, but attribution and procedure claims must come from evidence.
Where practitioners use this concept
- Threat briefing
- Incident reporting
- Detection tuning
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.