Gain comprehensive visibility and control over your network security with AlgoSec Horizon Security Analyzer. Simplify audits, optimize configurations, and enhance protection. AlgoSec Horizon Security Analyzer - See the whole picture ---- ------- Schedule a Demo Select a size ----- Get the latest insights from the experts Choose a better way to manage your network

Over 90% gross dollar retention and 37% year-over-year new business growth reflect demand for visibility across complex hybrid environments AlgoSec Posts 37% YoY new Business Growth in 2025 as Enterprises Prioritize Application-Centric Security Over 90% gross dollar retention and 37% year-over-year new business growth reflect demand for visibility across complex hybrid environments February 18, 2026 Speak to one of our experts RIDGEFIELD PARK, NJ, February 18, 2026 – AlgoSec , a global cybersecurity leader, today reported its best year ever with strong year-over-year annual recurring revenue growth, a gross dollar retention rate exceeding 90% and 37% year-over-year new business growth in 2025. The results reflect continued demand for greater visibility and control over application connectivity across hybrid and multi-cloud environments . Founded in 2004, AlgoSec has maintained positive cash flow and remained debt-free throughout its history. Enterprises faced increasing complexity throughout 2025 as application environments spanned data centers, cloud and hybrid infrastructure. That complexity was reflected in AlgoSec’s 2025 State of Network Security Report , based on insights from over 500 cloud and network security professionals globally, which found that multi-cloud environments are now the norm, with Azure emerging as the most widely used cloud platform among respondents. The report also found that automating application connectivity has become the top priority for minimizing risk and downtime as environments continue to expand. In response to these challenges, large, distributed enterprises adopted AlgoSec in 2025. New customers included Vodacom Business, NTT DATA Spain, Gainwell Technologies LLC – Texas, Lamborghini and more. AlgoSec consistently earns high satisfaction scores from real users, scoring 4.5 out of 5 on both G2 and Gartner Peer Insights , outperforming matching peers and being recognized as customer choice in Gartner’s Voice of the Customer report and #1 in PeerSpot . Additionally, AlgoSec’s 4.5 out of 5 Glassdoor rating places the company among top-tier employers. The AlgoSec Horizon platform, released in 2025, is recognized as the industry’s first application-centric security management and automation platform designed specifically for hybrid networks. The platform provides a single source of visibility across multi-clouds and data center environments, enabling security teams to prioritize risk based on business needs while managing security at scale. Through AI-driven visibility and risk mitigation that automatically discovers applications and maps connectivity dependencies, AlgoSec Horizon reduces operational friction, minimizes misconfigurations and supports faster, safer application delivery. “Today’s security teams are managing unprecedented levels of application and infrastructure complexity,” said Yuval Baron , AlgoSec CEO and co-founder. “2025 has been our best year ever. In just a few months, over 100 customers have implemented the AlgoSec Horizon platform. This rapid adoption highlights enterprises’ strategic need for a single platform to secure their hybrid estate, often spanning multiple cloud platforms and data centers. At the same time, organizations must accelerate application connectivity to speed delivery. Together, these capabilities are essential for driving growth and innovation in the AI era.” AlgoSec’s application-centric approach was also recognized by the industry in 2025 , earning the 2025 SC Award for Best Security Company from SC Media at RSAC, a Global InfoSec Award from Cyber Defense Magazine for Best Service as a Cybersecurity Company, and Trailblazer recognition in Network Security and Management from Cyber Defense Magazine’s Top InfoSec Innovator Awards. For more on AlgoSec’s 2025 achievements and innovations, visit www.algosec.com .

Organizations of all sizes can now protect their cloud-native applications easily and cost-effectively across containers and all other cloud assets AlgoSec acquires Prevasio to disrupt the Agentless Cloud Security market Organizations of all sizes can now protect their cloud-native applications easily and cost-effectively across containers and all other cloud assets December 7, 2022 Speak to one of our experts Ridgefield Park, NJ, December 6, 2022 – AlgoSec, a global cybersecurity leader in securing application connectivity, announced today that it has acquired Prevasio, a SaaS cloud-native application protection platform (CNAPP) that includes an agentless cloud security posture management (CSPM) platform, anti-malware scan, vulnerability assessment and dynamic analysis for containers. As applications rapidly migrate to the Cloud, security teams are being flooded with alerts. These teams are struggling to detect and prioritize risks through Cloud providers’ native security controls, especially in multi-cloud environments. Furthermore, security teams are hard-pressed to find solutions that meet their budgetary restrictions. To answer this need, AlgoSec will offer the Prevasio solution at aggressive pricing to new customers, as well as the existing 1,800 blue chip enterprise organizations they currently serve, allowing them to reduce their cloud security costs. Prevasio’s user-friendly, cost-effective SaaS solution is designed for hardening security posture across all cloud assets, including containers. The solution provides increased visibility into security issues and compliance gaps, enabling the cloud operations and security teams to prioritize risks and comply with CIS benchmarks. Prevasio customers have successfully reduced administration time and achieved operational cost reductions, even across small teams, within days of operationalization. Leveraging patented technology developed by SRI International, one of the world’s largest research institutes and the developer of Siri and many other leading technologies, Prevasio’s key capabilities include: Analysis of all assets across AWS, Azure, and Google Cloud, offering a unified view in a single pane of glass Prioritized risk according to CIS benchmarks, HIPPA and PCI regulations Blazing fast static- and dynamic- agentless vulnerability scanning of containers Assessment and detection of cybersecurity threats Instantaneous connection to AWS, Azure, or Google Cloud accounts without installation or deployment Furthermore, AlgoSec will incorporate SRI artificial intelligence (AI) capabilities into the Prevasio solution. “Applications are the lifeblood of organizations. As such, our customers have an urgent need to effectively secure the connectivity of those applications across cloud and hybrid estates to avoid unpleasant surprises. With Prevasio, organizations can now confidently secure their cloud-native applications to increase organizational agility and harden security posture,” said Yuval Baron, AlgoSec CEO. For a free trial of the Prevasio solution, click here . About AlgoSec AlgoSec, a global cybersecurity leader, empowers organizations to secure application connectivity by automating connectivity flows and security policy, anywhere. The AlgoSec platform enables the world’s most complex organizations to gain visibility, reduce risk, achieve compliance at the application-level and process changes at zero-touch across the hybrid network. AlgoSec’s patented application-centric view of the hybrid network enables business owners, application owners, and information security professionals to talk the same language, so organizations can deliver business applications faster while achieving a heightened security posture. Over 1,800 of the world’s leading organizations trust AlgoSec to help secure their most critical workloads across public cloud, private cloud, containers, and on-premises networks. About Prevasio Prevasio, an AlgoSec company, helps organizations of all sizes protect their cloud-native applications across containers and all other cloud assets. Prevasio’s agentless cloud-native application protection platform (CNAPP) provides increased visibility into security and compliance gaps, enabling the cloud operations and security teams to prioritize risks and ensure compliance with internet security benchmarks. Acquired by AlgoSec in 2022, Prevasio combines cloud-native security with SRI International’s proprietary AI capabilities and AlgoSec’s expertise in securing 1,800 of the world’s most complex organizations.

Understand HIPAA network compliance requirements. Learn how to safeguard patient data with robust network security measures and ensure compliance with HIPAA regulations. HIPAA network compliance & security requirements explained ---- ------- Schedule a Demo Select a size ----- Get the latest insights from the experts Use these six best practices to simplify compliance and risk mitigation with the AlgoSec platform White paper Learn how AlgoSec can help you pass PCI-DSS Audits and ensure continuous compliance Solution overview See how this customer improved compliance readiness and risk management with AlgoSec Case study Choose a better way to manage your network

Learn the basics of managing multiple workloads in the cloud and how to create a successful enterprise level security management program Webinars Journey to the Cloud Learn to speed up application delivery across a hybrid cloud environment while maintaining a high level of security Efficient cloud management helps simplify today’s complex network environment, allowing you to secure application connectivity anywhere. But it can be hard to achieve sufficient visibility when your data is dispersed across numerous public clouds, private clouds, and on-premises devices. Today it is easier than ever to speed up application delivery across a hybrid cloud environment while maintaining a high level of security. In this webinar, we’ll discuss: – The basics of managing multiple workloads in the cloud – How to create a successful enterprise-level security management program – The structure of effective hybrid cloud management July 5, 2022 Stephen Owen Esure Group Omer Ganot Product Manager Relevant resources Cloud atlas: how to accelerate application migrations to the cloud Keep Reading A Pragmatic Approach to Network Security Across Your Hybrid Cloud Environment Keep Reading 6 best practices to stay secure in the hybrid cloud Read Document Choose a better way to manage your network Choose a better way to manage your network Work email* First name* Last name* Company* country* Select country... Short answer* By submitting this form, I accept AlgoSec's privacy policy Continue

Assessing the Value of Network Segmentation from a Business Application Perspective Download PDF Download PDF Add a Title Add a Title Add a Title Schedule time with one of our experts Work email* First name* Last name* Company* country* Select country... Short answer* By submitting this form, I accept AlgoSec's privacy policy Continue

Learn about the nuances of cloud network security and why it’s a strategic imperative. Cloud network security strategic imperative Select a size Which network Can AlgoSec be used for continuous compliance monitoring? Yes, AlgoSec supports continuous compliance monitoring. As organizations adapt their security policies to meet emerging threats and address new vulnerabilities, they must constantly verify these changes against the compliance frameworks they subscribe to. AlgoSec can generate risk assessment reports and conduct internal audits on-demand, allowing compliance officers to monitor compliance performance in real-time. Security professionals can also use AlgoSec to preview and simulate proposed changes to the organization’s security policies. This gives compliance officers a valuable degree of lead-time before planned changes impact regulatory guidelines and allows for continuous real-time monitoring. Cloud network security explained What is cloud network security? Core components of cloud network security Why is cloud network security critical? Recommendations for cloud network security How AlgoSec tackles complex cloud network security challenges Conclusion FAQs Get the latest insights from the experts Schedule time with one of our experts Work email* First name* Last name* Company* country* Select country... Short answer* By submitting this form, I accept AlgoSec's privacy policy Continue

Best practices for network security governance in AWS and hybrid network environments Webinars Cut the Clutter with ChatOps & Improve Network Security IT teams’ alerts are overflowing with questions about network status from coworkers. Say no to overwhelming alerts in multiple applications. There is a better way to get critical answers about the state of your network: ChatOps. ChatOps, using your existing chat tools such as Slack or Microsoft Teams, can get the crucial questions answered, and not have to track multiple apps separately. In this webinar, Dania Ben Peretz, Product Manager at AlgoSec, demonstrates the latest in AlgoBot and show how to: Get immediate answers to pressing network traffic questions Get immediate answers about whether your business applications are secure Decrease the time it takes to resolve critical security incidents Empower your business and application teams to drive innovation Ensure that your network and security teams are focusing on the most critical issues Efficiently manage security by transparently collaborating with IT, Security, Network and DevOps teams All while saving time, reducing resources, and cutting the clutter. May 13, 2020 Dania Ben Peretz Product Manager Relevant resources AlgoBot: Your Network Security Policy Management Assistant Watch Video Boosting Network Security with ChatOps Keep Reading A Siri for network security: the benefits of AlgoBot and ChatOps Keep Reading Choose a better way to manage your network Choose a better way to manage your network Work email* First name* Last name* Company* country* Select country... Short answer* By submitting this form, I accept AlgoSec's privacy policy Continue

Update to AlgoSec’s Network Security Management Suite enhances support for leading vendors and extends Cisco integration, giving unrivalled application visibility, change automation and control AlgoSec A30.10 Delivers Enhanced Cloud, SDN and Network Security Management for Cisco ACI, Tetration & FirePower, Microsoft Azure, F5 AFM and Juniper Junos Space Update to AlgoSec’s Network Security Management Suite enhances support for leading vendors and extends Cisco integration, giving unrivalled application visibility, change automation and control April 2, 2020 Speak to one of our experts RIDGEFIELD PARK, N.J., April 2, 2020 – AlgoSec , the leading provider of business-driven network security management solutions, has released the version A30.10 update of its core Network Security Management Suite, which offers new cloud security management capabilities and a range of enhanced features that further extend its technology ecosystem integrations. The AlgoSec Security Management Suite (ASMS) A30.10 builds on A30’s market-leading automation capabilities to enable seamless, zero-touch security management across SDN, cloud and on-premise networks. This gives enterprises the most comprehensive visibility and control over security across their entire hybrid environment. Key features in ASMS A30.10 include: Extended support for Cisco ACI, Tetration and FirePower ASMS A30.10 offers enhanced support for Cisco solutions, including AlgoSec Horizon AppViz integration with Cisco Tetration, giving enhanced application visibility and network auto-discovery to dramatically accelerate identification and mapping of the network attributes and rules that support business-critical applications. The update also extends Cisco ACI Network Map modeling and Visibility. AlgoSec provide accurate and detailed traffic simulation query results and enables accurate intelligent automation for complex network security changes. ASMS now also provides Baseline Compliance reporting for Cisco Firepower devices. AlgoSec Horizon Security Analyzer Administrators can select a specific baseline profile, either the one provided by AlgoSec out-of-the box, a modified version, or they can create their own custom profile. Enhanced automation for F5 AFM and Juniper Junos Space ASMS A30.10 provides enhanced automation through Horizon FireFlow support for F5 AFM devices and several Juniper Junos Space enhancements including: – ActiveChange support for Junos Space: ActiveChange enables users to automatically implement work order recommendations via the Juniper Junos Space integration, directly from Horizon FireFlow. – Enhances Granularity support of Virtual Routers, VRFs, and Secure Wires for a greater level of route analysis and accurate automation design. Technology ecosystem openness ASMS A30.10 offers increased seamless migrations to virtual appliances, AlgoSec hardware appliances, or Amazon Web Services/Microsoft Azure instances. Easy device relocation also enables system administrators on distributed architectures to relocate devices across nodes. The update carries ASMS API improvements, including enhanced Swagger support, enabling the execution of API request calls and access lists of request parameters directly from Swagger. ASMS A30.10 also introduces new graphs and dashboards in the AlgoSec Reporting Tool (ART), which have an executive focus. New multi-cloud capabilities ASMS A30.10 offers streamlined access to CloudFlow, providing instant visibility, risk detection, and mitigation for cloud misconfigurations and simplifies network security policies with central management and cleanup capabilities. “As organizations accelerate their digital transformation initiatives, they need the ability to make changes to their core business applications quickly and without compromising security across on-premise, SDN and cloud environments. This means IT and security teams must have holistic visibility and granular control over their entire network infrastructure in order to manage these processes,” said Eran Shiff, Vice President, Product, of AlgoSec. “The new features in AlgoSec A30.10 make it even easier for these teams to quickly plan, check and automatically implement changes across their organization’s entire environment, to maximize business agility while strengthening their security and compliance postures.” AlgoSec’s ASMS A30.10 is generally available. About AlgoSec The leading provider of business-driven network security management solutions, AlgoSec helps the world’s largest organizations align security with their mission-critical business processes. With AlgoSec, users can discover, map and migrate business application connectivity, proactively analyze risk from the business perspective, tie cyber-attacks to business processes and intelligently automate network security changes with zero touch – across their cloud, SDN and on-premise networks.Over 1,800 enterprises , including 20 of the Fortune 50, utilize AlgoSec’s solutions to make their organizations more agile, more secure and more compliant – all the time. Since 2005, AlgoSec has shown its commitment to customer satisfaction with the industry’s only money-back guarantee . All product and company names herein may be trademarks of their registered owners. *** Media Contacts:Tsippi [email protected] Craig CowardContext Public [email protected]+44 (0)1625 511 966

AlgoSec & Palo Alto Networks AlgoSec seamlessly integrates with Palo Alto Networks NGFWs to automate application and user aware security policy management and ensure that Palo Alto Networks’ devices are properly configured. AlgoSec supports the entire security policy management lifecycle — from application connectivity discovery, through ongoing management and compliance, to rule recertification and secure decommissioning. Solution brief View webinar How to Regulatory compliance Learn how to prepare for a regulatory audit Risk Assessment Learn how to assess risk on your Palo Alto devices with AlgoSec Palo Alto Ignite See how Palo Alto Users Can Benefit from AlgoSec Schedule time with one of our experts Explore the partnership Enhance Your Palo Alto Networks Environment With AlgoSec Read document Palo Alto Networks and AlgoSec Solution Brochure Read document Protecting Your Network’s Precious Jewels with Micro-Segmentation, Kyle Wickert, AlgoSec Watch Download these resources to discover more about our partnership with Palo Alto Networks

Learn how application-centric firewall rule recertification connects rules to applications, owners, business need, and audit evidence before access changes. What is application-centric firewall rule recertification? What is application-centric firewall rule recertification and why is it better than rule-based review? During a recurring firewall review, application owners are often sent a spreadsheet filled with rule IDs, source and destination objects, services, comments, and hit counts. Then they are asked to certify access they cannot easily connect to a business service. A rule may look inactive yet support a disaster-recovery path. It may also be shared by several applications, so one yes-or-no answer can keep obsolete access or remove something another team still needs. Application-centric firewall rule recertification changes the unit of review. Instead of treating firewall rules as isolated technical objects, teams review the applications and connectivity flows those rules support. They combine ownership, business justification, usage, dependencies, risk, exceptions, and change history to decide which flows should be approved, changed, or removed. The decision is then translated into governed policy changes and retained as evidence for audit readiness. Schedule a Demo Why rule-by-rule recertification loses business context Traditional recertification starts with the rule. That makes sense to a firewall administrator, but it is often the wrong starting point for an application owner. A row containing source 10.20.4.0/24, destination db-prod-02, and TCP 1521 does not explain which application needs the connection, whether the traffic is seasonal, or what would break if access were narrowed. Hit counts and comments help, but they do not provide a decision by themselves. A quiet rule may be reserved for failover or month-end processing. A busy rule may still be broader than the application requires. Comments can be outdated, and the listed owner may have moved roles. At enterprise scale, network security management spans multiple devices, records, and teams. These gaps turn a scheduled review into an investigation across tickets, configuration records, and several conversations. Shared rules make the problem harder. One rule might allow flows for a billing application, a reporting service, and a migration tool. If the migration is finished, the right outcome may be to remove only the obsolete source, destination, or service combination. The business decision belongs at the flow level; the rule remains the enforcement object. Schedule a Demo What changes when applications and flows become the unit of review An application-centric approach starts with the service the business still needs. It connects that service to its owner, required connectivity flows, underlying rules, usage evidence, and relevant risk or exception data. This is closely related to application connectivity management : teams need to understand which connections support the application before a reviewer approves a change. That shift gives stakeholders a common language. Application owners confirm business need. Security and network teams assess scope and impact. Compliance teams see who reviewed the access and what evidence supported the decision. Change owners can then convert an approved decision into a controlled policy update. Rule-by-rule review vs. application-centric recertification Review dimension Rule-by-rule review Application-centric recertification Unit of review One firewall rule or policy object The application and its required connectivity flows Primary question Is the rule present, used, and valid? Which application needs each flow, who owns it, and why? Evidence Rule fields, comments, hit counts, and configuration Ownership, business need, traffic, dependencies, risk, exceptions, expiry, and history Decision Reapprove or flag the rule for cleanup Approve, change, or remove flows, then govern the resulting policy change Audit record Rule status and reviewer response Application, owner, flow, reason, decision, exception, change, and evidence A rule-centric campaign can produce a status for each rule while still leaving engineers to reconstruct what the reviewer meant. An application-centric campaign records which flows remain justified and what should happen next. That makes the result more useful for firewall policy cleanup without treating a cleanup candidate as authorized for removal. Schedule a Demo How an application-centric recertification cycle works A practical cycle moves through six connected stages: scope the review, map relationships, enrich the record, route it to accountable reviewers, record flow-level decisions, and implement approved changes while preserving evidence. Automation can support repetitive work, but ownership and impact decisions remain governed. Map applications, connectivity flows, rules, and owners Start by defining the applications, environments, policies, or review period in scope. Map each application to its required source, destination, service, protocol, and access path, then associate those flows with the rules or cloud controls that enforce them. Because one rule may serve several applications, the model needs to support many-to-many relationships rather than assign one rule to one owner. Roles also need context. The application owner explains why a connection exists; the firewall or network team understands how it is implemented. Risk or compliance owners may need to review sensitive zones, privileged services, or exceptions. Clear accountability reduces repeated outreach and exposes ownership gaps early. Review evidence and record flow-level decisions Before asking for a decision, enrich the record with recent and historical traffic, application status, business justification, asset criticality, exposure, exceptions, expiration dates, prior decisions, and pending changes. Usage is evidence, not a verdict. A flow that looks quiet during a short observation window may be needed for quarterly processing or disaster recovery. Reviewers can approve a flow as defined, request that it be narrowed or corrected, remove it because the business need has ended, or document an exception with an owner and review date. Different flows on a shared rule can receive different decisions. Routing, reminders, deadlines, and decision tracking can be automated while accountable people make the business and risk judgment. Govern policy changes and preserve the audit trail A recertification decision is not the same as a deployed firewall change. Approved modifications should move through security policy change management with impact analysis, required approvals, implementation planning, validation, and rollback where appropriate. The final record should connect the application and flow to the reviewer, decision, exception, change ticket, implementation result, and retained evidence. That trail supports continuous compliance for firewall and network security policies because teams can show how access was reviewed and what happened afterward. It also reduces the effort of rebuilding the story during an audit. The evidence supports audit readiness; it does not replace the organization's responsibility to interpret its policies and applicable requirements. Schedule a Demo Where teams need extra care Some access looks unnecessary until the business calendar is considered. A financial-close flow may run only a few times a year, while a disaster-recovery connection may stay quiet until a test or incident. Before narrowing it, reviewers should confirm the scenario, owner, last successful use, and expected test cadence. Decommissioning also requires flow-level precision. If an old reporting application and a current customer portal share one rule, retiring the reporting application does not make the rule obsolete. The approved change may remove one source object or service while preserving the portal's path. Temporary vendor access and migration exceptions need the same discipline: an owner, business reason, expiration date, and governed removal when the work ends. Schedule a Demo How AlgoSec Horizon supports application-centric recertification AlgoSec Horizon helps teams connect firewall rules to the applications, connectivity flows, owners, risk, review decisions, and audit evidence those rules support. This platform view helps security, network, application, compliance, and audit stakeholders move from a rule list to a shared understanding of business access across hybrid environments. Within a recertification cycle, the platform supports the context needed to review whether an application still exists, whether a flow remains required, who owns the decision, and whether access should be approved, changed, or removed. It also helps connect review outcomes to governed change work and retained evidence. In practice, that can reduce manual investigation, support more consistent review campaigns, strengthen audit readiness, and help teams make better risk decisions without handing approval to an automated process. Schedule a Demo Frequently asked questions Is application-centric recertification the same as firewall policy cleanup? No. Recertification produces an accountable decision about whether access is still justified and appropriately scoped. Cleanup implements approved changes, such as removing an obsolete flow, narrowing an object, or retiring a rule through a governed process. Can firewall rule recertification be automated? Parts of it can. Automation can collect evidence, map records, route reviews, send reminders, track deadlines, and create change work. Application owners and security stakeholders still need to validate business need, impact, risk, and exceptions, especially for sensitive or shared access. How often should firewall rules be recertified? Use a cadence based on internal policy, access risk, application criticality, change frequency, and applicable requirements. High-risk or temporary access may need more frequent review than stable, lower-risk connectivity. The schedule should be documented and repeatable. See how AlgoSec Horizon can help your team connect firewall rules to applications, owners, connectivity flows, and audit evidence for governed recertification across hybrid networks. Schedule a Demo Select a size What is application-centric firewall rule recertification and why is it better than rule-based review? Why rule-by-rule recertification loses business context What changes when applications and flows become the unit of review How an application-centric recertification cycle works Where teams need extra care How AlgoSec Horizon supports application-centric recertification Frequently asked questions Get the latest insights from the experts Choose a better way to manage your network

MITRE ATT&CK offers an open source framework for understanding adversarial tactics, techniques, and common knowledge in use today. MITRE attack framework Select a size Which network Can AlgoSec be used for continuous compliance monitoring? Yes, AlgoSec supports continuous compliance monitoring. As organizations adapt their security policies to meet emerging threats and address new vulnerabilities, they must constantly verify these changes against the compliance frameworks they subscribe to. AlgoSec can generate risk assessment reports and conduct internal audits on-demand, allowing compliance officers to monitor compliance performance in real-time. Security professionals can also use AlgoSec to preview and simulate proposed changes to the organization’s security policies. This gives compliance officers a valuable degree of lead-time before planned changes impact regulatory guidelines and allows for continuous real-time monitoring. What is the MITRE ATT&CK® framework? MITRE ATT&CK offers an open source framework for understanding adversarial tactics, techniques, and common knowledge in use today. It aggregates and catalogs cyber threats based on real-world adversary behavior observed across thousands of incidents, and outlines defenses to protect organizations against them. MITRE ATT&CK helps organizations understand how adversaries operate and guides them towards developing security measures to protect their assets and operations. Understanding the MITRE ATT&CK layout MITRE ATT&CK is organized into three matrices, each representing a dedicated technology domain: Enterprise Mobile Industrial control systems (ICS) Most organizations will use the enterprise matrix, which covers attacks against Windows, macOS, Linux, cloud platforms, network infrastructure, and containers. However, companies must first understand what malicious actors are seeking to achieve. Tactics The enterprise matrix opens to 14 columns representing adversary tactics, i.e., high-level goals: Initial access (getting in) through execution Reconnaissance Persistence Execution Privilege escalation Exfiltration and impact Next, comes the how. Techniques and Sub-Techniques Each tactic column leads to rows containing techniques and sub-techniques, i.e., specific methods for achieving a goal. The latest MITRE ATT&CK v18 features 8 to 47 techniques for each tactic. For example, under Reconnaissance, there are 11 techniques, including “Active Scanning” and “Phishing for Information.” Persistence lists techniques such as "Create Account" or "Boot or Logon Autostart Execution." Sub-techniques are nested within techniques for specific attack implementations. For instance, under "Phishing," you have "Spearphishing Attachment," "Spearphishing Link," "Spearphishing via Service," and “Spearphishing Voice.” This granularity is key, as you need a different technique to defend against phishing via email attachments than via compromised messaging platforms. MITRE ATT&CK Matrix The MITRE ATT&CK Matrix catalogs adversaries into groupings such as data sources, cyber threat intelligence (CTI) groups, and defense strategies. This allows users to filter their navigation to specific adversaries, tools, and campaigns relevant to their business operations. MITRE ATT&CK is constantly updated as adversaries and their tactics, techniques, and procedures (TTPs) evolve. Each version has new features based on empirical threat intelligence, incident response findings, and community research. This is especially important in the face of emerging threat trends, such as AI-assisted cyberattacks and the growth of ransomware-as-a-service (RaaS). Benefits of the MITRE ATT&CK framework MITRE ATT&CK doesn’t simply offer threat intelligence but also shapes organizations’ security operations for multiple use cases: Threat intelligence gathering: Gain context for cloud indicators of compromise (IOCs); beyond "bad IP address detected," know if the address is associated with a specific technique adversaries use for command and control. Threat hunting: Use a hypothesis-driven approach to systematically hunt for evidence of specific techniques used, instead of randomly searching logs. Attack simulation and red team exercises: Leverage real-world, standardized playbooks for testing both offensive capabilities and defensive responses; map your red team's successful tactics against your blue team's detection rates to identify coverage gaps with precision. Gap analysis: Visualize which techniques you can detect, which you can prevent, and most importantly, which represent blind spots in your security architecture. Response validation: Test whether your incident response procedures actually work against the techniques most relevant to your threat profile. The use cases above are a proof of concept, but the bottom line is the actual benefits companies reap from them: Shared understanding of the threat landscape: MITRE ATT&CK offers a common language for discussing adversaries across technical teams, executives, and even board members. Accurate simulation of attacks and validation of defenses: Mapped exercises tell you whether you can detect and respond to techniques adversaries actually use. Informed development and deployment of security policies: Craft policies that specifically address the techniques most relevant to your business risk profile. Intelligent selections of security solutions: Ask vendors which ATT&CK techniques they address and check those claims against your coverage gaps. Best practices for MITRE ATT&CK mapping The MITRE ATT&CK framework's value comes from mapping security data to specific ATT&CK techniques. But mapping without context is like having a map without knowing your starting location; it’s technically interesting, but operationally useless. The CISA best practices guide identifies two fundamental approaches to ATT&CK mapping: Mapping into finished reports (creating security insights for decision-making) Mapping into raw data (embedding ATT&CK context into operational security workflows). Understanding which approach fits your business needs is crucial. Mapping MITRE ATT&CK into finished reports This approach starts with collating incident reports, threat intelligence, or post-mortem analyses, extracting behavioral patterns, and then translating them into ATT&CK language. This creates artifacts that inform security strategy, resource allocation, and executive communication. The process follows six steps: Find the behavior. Identify specific actions the adversary took. Look beyond IoCs, such as malware names and IP addresses, to “how the adversary interacted with specific platforms and applications.” Research the behavior. Was this a standard administrative task gone rogue or a sophisticated persistence mechanism? Investigate the original source, technical details, timing, and surrounding activity. Consult malware analysis reports from reliable organizations, security reports, or your own forensic data. Translate the behavior into a tactic. Map the identified behavior to one of the tactics in the MITRE framework. Identify the technique used for the tactic. For example, within the Execution tactic, scan for the technique that best describes the method. ATT&CK provides detailed descriptions for each technique to help you map to the right one. Identify the sub-techniques. Was it a Windows scheduled task? A Linux Cron job? The sub-technique matters because detection and mitigation strategies for each differ significantly. Compare results to those of other analysts. CISA recommends that analysts treat mapping as a team sport where they work together to identify ATT&CK techniques and ensure quality control. Different analysts examining the same behavior should arrive at the same ATT&CK mapping. Mapping MITRE ATT&CK into raw data While finished reports inform strategy, mapping into raw data enables operations. This approach embeds ATT&CK context directly into your detection engineering, threat hunting, and daily security workflows. Organizations can choose from three viable starting points, each suited to different operational scenarios. 1. Start with a data source A specific data source , say, authentication logs from your cloud identity provider, allows you to see what ATT&CK techniques generate observable activity in these logs. For authentication logs, you would map to techniques like "Valid Accounts," "Brute Force," and "Credential Stuffing." You would then define procedures, i.e., the specific log patterns that indicate these techniques in action. This approach is ideal when deploying new data sources or optimizing existing ones. 2. Start with specific tools or attributes If threat intelligence indicates adversaries targeting your industry are using a specific software , malware family, or penetration testing tool, you can start mapping from there. After identifying techniques that the tool enables, you can then look up the groups and campaigns that have implemented these techniques. Cobalt Strike (S0154) , for example, maps to dozens of techniques across multiple tactics. By understanding this breadth, you can develop ways of identifying not just the tool itself but the behaviors it facilitates. 3. Start with analytics Just as adversaries use software to target businesses, analysts can use cloud enterprise tools to track adversary behavior. SIEM platforms like the AlgoSec Cloud Enterprise (ACE) have built-in detection rules that collect, log, and correlate events from multiple endpoints, cloud services, and identity providers. These events originate as raw telemetry, which are then mapped to specific MITRE ATT&CK techniques. Mapping with detection analytics from such tools is increasingly the most practical approach for organizations with mature security tooling. Note: Mapping into raw data shouldn't exist in isolation. Operational mappings should ultimately feed into finished reports. Your day-to-day detection analytics reveal what you're actually seeing in your environment. These observations, aggregated and analyzed over time, become the foundation for strategic reporting. How to ACE your operations with the MITRE ATT&CK framework Enterprises generate millions of security events daily across cloud infrastructure, endpoints, network boundaries, and SaaS applications. With this deluge, it is unreasonable to expect analysts to hand-map behaviors. Enter AlgoSec Cloud Enterprise (ACE), a cloud enterprise tool that offers full visibility into your operations by collecting log data, aggregating and contextualizing it, and then mapping it automatically to MITRE ATT&CK techniques. This transforms raw telemetry streams into structured threat intelligence aligned with the MITRE ATT&CK framework. ACE’s finished reports provide a clear, risk-oriented view of your adversary exposure, using language that every analyst and decision-maker can understand. See why more than 2,200 companies trust AlgoSec. Schedule a demo today. Get the latest insights from the experts Schedule time with one of our experts Work email* First name* Last name* Company* country* Select country... Short answer* By submitting this form, I accept AlgoSec's privacy policy Continue