SECAI Core · phase 11 of 15 · noun

Tactics, techniques, and procedures

Analysis of historical cyberattacks and adversary actions.

The Explain card

Plain English
Tactics, techniques, and procedures describe how adversaries actually operate, drawn from analysis of past attacks. Tactics are the goals, techniques are the methods, procedures are the specific steps.
Example
A threat report notes that a group gains initial access via phishing (tactic), uses malicious model files to execute code (technique), and specifically plants pickle payloads on a sharing hub (procedure).
Why it matters
TTPs let defenders anticipate rather than react. Frameworks like MITRE ATT&CK and ATLAS map them so AI teams can test detections against known adversary playbooks.
Hook
Know the playbook before the game starts.

Word knowledge

How the word is built, where it came from, and what it sits beside in memory.

In a sentence

The incident-response team mapped the phishing email, PowerShell command, and persistence mechanism to documented tactics, techniques, and procedures.

Why these words
  • tactics Greek taktikē, art of arrangement, through French tactique supplies the broadest plural noun in the three-part sequence
  • techniques French technique, from Greek tekhnikos, relating to skill or craft supplies the middle plural noun and narrows the sequence toward particular methods
  • and Old English and, also meaning and coordinates the final item with the preceding two
  • procedures French procédure, from Latin procedere, to go forward completes the sequence with a plural noun for ordered steps
Where it came from
Origin
Modern English military terminology combining tactics, techniques, and procedures, three nouns with Greek, French, and Latin histories
Entered the language
20th century
What changed
The three existing words became a fixed military triad, commonly shortened to TTP, and later passed into cybersecurity vocabulary.
How it is spelled
Pattern
Each content word carries the regular plural suffix -s.
Pattern
Techniques preserves the French final -que spelling, pronounced /k/.

Spelled like

  • attacks
  • methods
  • unique
  • critique
Broken into chunks
  • tactic
    • tactical
    • tactician
  • techni
    • technical
    • technician
  • proced
    • proceed
    • procedural
What it sits beside

Same subject

  • threat intelligence
  • MITRE ATT&CK
  • adversary emulation
  • indicators of compromise

Same shape

  • policies, standards, and procedures
  • people, processes, and technology

cybersecurity knowledge structures

  • attack trees
  • threat models
  • incident-response playbooks

Where it sits in the deck

Phase 11: Threat Landscape: Attack Vectors and Adversarial Techniques

With defences named, learn what they must defend against — the full catalogue of attack techniques targeting AI systems, their inputs, outputs, training pipelines, and supply chains.

Neighbours in this phase