MITRE ATLAS: What It Is and How to Use the AI Threat Matrix

MITRE ATLAS (Adversarial Threat Landscape for Artificial-Intelligence Systems) is a public knowledge base of adversary tactics, techniques and procedures (TTPs) that target AI systems. This guide is for security, risk and governance staff who need to know what ATLAS is, where its authoritative data lives, which file or tool to use for which job, and where it stops being useful. Facts below were read from the project’s official GitHub repositories on 2026-11-07.

What is the MITRE ATLAS framework?

ATLAS describes how adversaries attack AI-enabled systems, organised as a matrix of tactics (the adversary’s goal) and techniques (how the goal is pursued), supported by case studies. The official atlas-data repository calls it “a public knowledge base of adversary TTPs targeting AI systems” and states that its YAML files are “the authoritative source of ATLAS data”. The content is credited to The MITRE Corporation and marked “Approved for Public Release; Distribution Unlimited”. The project’s home is atlas.mitre.org, and its code and data are published under the mitre-atlas GitHub organization.

ATLAS data objects can carry external references to MITRE ATT&CK, which MITRE describes as a knowledge base of adversarial techniques based on real-world observations. ATT&CK group IDs (G####) are kept separate from ATLAS entity IDs, so the two can be used side by side.

What is MITRE?

The ATLAS and ATT&CK pages name The MITRE Corporation as the author and copyright holder of the material. This guide states nothing further about the organization, and it does not rank it: the sources read describe what MITRE publishes, not how it compares with other bodies. Judge the framework by its data, its versioning and its documented limits, covered below.

Who runs it and what it covers

The data is maintained in the atlas-data repository (tactics, techniques and case studies). The wider organization also publishes the following official projects, each with a different job.

Repository	Purpose, per its own description
atlas-data	The authoritative YAML data: tactics, techniques, case studies
atlas-navigator	TypeScript web app to navigate and annotate ATLAS matrices, forked from the ATT&CK Navigator
atlas-navigator-data	STIX JSON and Navigator layers for the Navigator
arsenal	CALDERA plugin for adversary emulation of AI-enabled systems
ai-risk-database	Tool for exploring AI supply chain risk (the “MITRE AI Risk Database” searchers ask about)
atlas-opencti-connector	Connector for the OpenCTI threat-intelligence platform
atlas-website	Source of the ATLAS website

The repositories do not publish counts of tactics, techniques or mitigations, and third-party pages quote different totals, so check the current YAML rather than relying on a number copied from an article.

How to use ATLAS data (JSON, YAML, STIX and Navigator)

This is the practical route for anyone searching for the “MITRE ATLAS JSON” or a tutorial. All steps come from the atlas-data README.

1. Open the atlas-data repository and go to the dist folder.
2. Use dist/ATLAS-latest.yaml for the latest content in the latest format. dist/ATLAS.yaml is deprecated.
3. Read dist/manifest.yaml, which maps each release to its files by format version. dist/v6/ holds the v6 format including migrated history, and dist/legacy/ holds the original-format history.
4. Note the two version numbers. Content versions use the pattern YYYY.MM.N (for example 2026.05); format versions are semantic versions (for example 6.x.x). Separate versioning began with content 2026.05 and format 6.0.0, so record both when you cite or pin ATLAS data.
5. For tooling, take the generated outputs: an ATLAS-only STIX JSON bundle (optionally combined with ATT&CK Enterprise), or one STIX 2.1 Attack Flow bundle per case study.
6. For spreadsheets, generate Excel workbooks with the atlas-to-excel tool named in the README.
7. For visual work, load the Navigator layers into atlas-navigator (the custom atlas-atlas domain) to annotate the matrix.
8. For testing, look at arsenal if you run CALDERA and want to emulate adversary behavior against an AI-enabled system.

What are the top 3 AI security risks?

ATLAS does not publish a ranked top three. It organises threats by adversary tactic and technique, and it records real-world case studies, so it answers “how can this system be attacked, and what has been observed” rather than “which risk matters most”. Prioritisation needs your own system context and a risk framework. For related CASRAI coverage of individual attack classes, see prompt injection and AI red teaming explained.

Strengths and limits

• Strength: a shared vocabulary. Tactic and technique names let red teams, defenders and auditors describe the same attack the same way, and the ATT&CK references let AI incidents connect to existing ATT&CK-based workflows.
• Strength: machine-readable and versioned. STIX, YAML, Navigator layers and Attack Flow bundles are published from one authoritative source with explicit content and format versions.
• Limit: it describes adversary behavior, not controls. The repositories describe a knowledge base of TTPs. It is not a certification scheme, a compliance checklist or a risk-scoring method.
• Limit: no ranking or prevalence. Nothing read from the official repositories ranks techniques by likelihood or impact.
• Limit: it changes. Content and format versions move independently, so a pinned file can go stale or break a parser after a format change.

Alternatives and companions

Resource	What it is (from its owner’s page)	Use it when
MITRE ATLAS	Knowledge base of adversary TTPs against AI systems	You need attack vocabulary, case studies and STIX/Navigator data for AI
MITRE ATT&CK	Knowledge base of adversarial techniques from real-world observation, with Enterprise, Mobile and ICS domains	You model conventional IT, mobile or industrial systems
NIST AI RMF 1.0 (26 January 2023)	Voluntary framework for managing AI risks to individuals, organizations and society	You need an organization-level risk management structure; see NIST AI RMF and the Generative AI Profile guide
garak	LLM vulnerability scanner (CASRAI guide)	You want to probe a language model rather than catalogue attacks

The table lists complementary resources, not ranked substitutes: ATLAS and ATT&CK describe attacker behavior, NIST AI RMF structures risk management, and a scanner tests a specific model. For the policy side of the distinction, see AI safety vs AI security.

Frequently asked questions

What is the MITRE ATLAS framework?

A public knowledge base of adversary tactics and techniques targeting AI systems, credited to The MITRE Corporation, with its authoritative data in the atlas-data repository.

How prestigious is MITRE?

The sources read do not rank MITRE, so this guide does not either. What can be checked is the material: it is public, versioned and published openly with source code.

Is there a MITRE ATLAS JSON file?

The authoritative format is YAML (dist/ATLAS-latest.yaml). STIX JSON bundles are generated for ATLAS alone or combined with ATT&CK Enterprise, and Navigator layers are published in the navigator data repository.

What is the MITRE AI Risk Database?

The official ai-risk-database repository is described as a tool for exploring AI supply chain risk. It is separate from the ATLAS matrix data.

Where do I find the matrix visually?

Use the ATLAS website at atlas.mitre.org, or run the atlas-navigator app with the published layers.

Sources

• mitre-atlas/atlas-data README, read 2026-11-07.
• mitre-atlas GitHub organization, read 2026-11-07.
• MITRE ATT&CK resources page, read 2026-11-07.
• NIST AI Risk Management Framework, read 2026-11-07.