Photo by KOBU Agency on Unsplash
191,561 Phishing Complaints in One Year
In 2025 the FBI’s Internet Crime Complaint Center recorded 191,561 phishing complaints. The same year Verizon’s Data Breach Investigations Report linked phishing to 16 percent of breaches. APWG logged 3.8 million phishing attacks worldwide that year. Each of those incidents carries a technique identifier in the ATT&CK framework. Analysts who receive an alert can tag it with the identifier T1566-Phishing and instantly know the attacker’s intended move. That tag is more than a label; it is a shortcut to a whole set of tactics, mitigations, and historical data.
The Matrix That Gives Attackers Names
The MITRE ATT&CK framework lists every known technique with a unique ID, such as "T1566-Phishing". The ID lets any analyst write a single code and convey a complete description to a colleague across the globe. The framework also groups techniques under tactics, the "why" of an attack. For phishing, the tactic is Initial Access, the technique is T1566, and the procedure is the specific phishing email used in a campaign. When a security product flags a malicious attachment, it can emit the ID T1566. The operation team then sees that the detection belongs to the Initial Access tactic and can compare it to other detections in the same column of the matrix. If the column shows many detections but the adjacent column for Credential Access is empty, a gap is visible.
From 14 to 15 Tactics: A Brief History
MITRE released the ATT&CK framework in 2013 as a public catalog of attacker behavior. By 2022 the matrix contained 14 tactic categories. In the 2026 version the number rose to 15, reflecting the split of the old Defense Evasion category into Stealth and Defense Impairment. The framework is versioned with a major.minor scheme; version 20 appeared in October 2026. CISA formally recognized the framework in its best‑practice guidance, cementing its role as a government‑endorsed standard for threat intelligence work. Those milestones show that the matrix is not static; it grows as real‑world observations accumulate.
Who Supplies the Playbooks and the Tools
MITRE maintains the core catalog, but many vendors build products around it. Palo Alto Networks’ Unit 42 team publishes remediation playbooks that reference the T1566 identifier and map the technique to specific response actions. The playbook describes how adversaries may send phishing messages to gain Initial Access and outlines steps to contain the breach. Security teams that adopt such playbooks can automatically generate a Course of Action when a detection is tagged with T1566. The shared vocabulary also lets threat‑intel reports from different firms speak the same language, because every report can cite the same ID. This common language reduces translation errors and speeds up coordination across organizations.
What a Blank Cell Means for Your Defenses
When analysts line up every detection on the matrix, the picture is stark. Columns filled with red cells show coverage; an empty column is a blind spot. A blank under Credential Access, for example, tells a defender that no rule currently catches techniques that harvest passwords. The matrix makes that omission obvious without digging through logs. The consequence is simple: attackers can exploit the uncovered technique while defenders remain unaware. The visual of a nearly full grid with a single white square is a reminder that even the most mature security program can overlook a single technique. The question for any security leader is whether that white square will stay empty long enough for an adversary to walk through it.
Sources
- ATT&CK — “where every technique has an ID, such as "T1566-Phishing". It gives the industry a shared vocabulary”
- What is phishing? How phishing attacks work and how to defend against them — “MITRE ATT&CK catalogues it as technique T1566 under the initial access tactic.”
- MITRE ATT&CK CoA - T1566 - Phishing | Cortex XSOAR — “Techniques Handled: T1566: Phishing Kill Chain phases: Initial Access MITRE ATT&CK Description: Adversaries may send phishing messages to gain access to victim systems.”
Top comments (0)