SECAI Core · phase 11 of 15
Tactics, techniques, and procedures
Analysis of historical cyberattacks and adversary actions.
The Explain card
- Plain English
- Tactics, techniques, and procedures describe how adversaries actually operate, drawn from analysis of past attacks. Tactics are the goals, techniques are the methods, procedures are the specific steps.
- Example
- A threat report notes that a group gains initial access via phishing (tactic), uses malicious model files to execute code (technique), and specifically plants pickle payloads on a sharing hub (procedure).
- Why it matters
- TTPs let defenders anticipate rather than react. Frameworks like MITRE ATT&CK and ATLAS map them so AI teams can test detections against known adversary playbooks.
- Hook
- Know the playbook before the game starts.
Where it sits in the deck
Phase 11: Threat Landscape: Attack Vectors and Adversarial Techniques
With defences named, learn what they must defend against — the full catalogue of attack techniques targeting AI systems, their inputs, outputs, training pipelines, and supply chains.
