What Is MITRE ATLAS?

MITRE ATLAS is a knowledge base of adversary tactics and techniques for attacks on AI-enabled systems. It gives teams a shared way to describe how an attacker may influence models, data, training pipelines, retrieval systems, or deployed AI applications.

A threat knowledge base, not a security product

ATLAS does not scan a system, certify a design, or block an attack. It organizes known attacker behaviors so a team can map them to its own assets and decide what to test, monitor, or mitigate. Treating an ATLAS technique as a finding without a system-specific path turns the framework into a checklist rather than a threat model.

The authoritative starting point is the MITRE ATLAS knowledge base. Use its current technique references when documenting a scenario, because technique names and relationships can evolve.

How teams use ATLAS in a threat model

Start with a concrete AI workflow: model, instructions, retrieved data, tools, identity, and downstream target. Then ask which attacker goal is plausible and where the attacker can enter. A retrieved document that changes a tool proposal, a poisoned dataset that shifts later output, and a stolen model credential are different paths even if they all affect the same user-facing agent.

An AI agent threat modeling guide can structure that local analysis. ATLAS adds a vocabulary for comparing the path to other AI-relevant techniques; it does not remove the need to document system boundaries and assumptions.

An agent example

Imagine an agent that retrieves vendor documents and can create purchase requests. A threat model can map untrusted text entering retrieval, the model interpreting it as instruction, a proposed procurement action, and the policy or approval step expected to stop it. The team can record the relevant ATLAS behavior, build a safe test document, and capture whether the purchase request was blocked before the target system changed.

That is more useful than claiming the agent “covers ATLAS.” Coverage has to be defined technique by technique, in a stated configuration, with evidence for prevention, detection, or response.

ATLAS, ATT&CK, and OWASP

MITRE ATT&CK describes adversary behavior across enterprise environments. ATLAS applies a similar knowledge-base approach to AI systems. OWASP guidance groups common application and agentic risks. These resources overlap in useful ways, but they answer different questions: a team may use OWASP to identify a risk class and ATLAS to describe an adversary path, then use ATT&CK for the surrounding identity or endpoint activity.

The prompt injection glossary is one example of a distinct application concept. It helps explain an instruction-trust failure. ATLAS helps place that failure in a broader adversarial technique and response discussion.

What good mapping looks like

For each selected technique, record the asset, assumed attacker access, entry point, expected control or telemetry, owner, and test result. Avoid a long list with no prioritization. A small number of credible paths tied to business impact is more actionable than every technique that mentions AI.

Where a workflow uses connected tools, inspect those components before assigning assurance. The MCP security tools review can inform a server review, while the ATLAS map explains how a compromised or misleading component might fit into an attack sequence.

When to reach for ATLAS

Use ATLAS when a team needs a common adversary vocabulary for design reviews, red-team planning, detection engineering, or incident analysis. Keep the output tied to a current system and a decision owner. The framework is valuable because it makes assumptions explicit, not because a mapped system becomes automatically secure.

The OWASP Agentic AI Top 10 is a complementary application-risk reference; it does not replace ATLAS technique mapping.