Are MITRE ATT&CK's tactic columns an ordered sequence an intrusion moves through?
answer
- two models, only one asserts order
- why is the grid drawn left to right?
- a goal held at a moment, not a step
- Discovery can repeat; Persistence can be absent
- ordering lives in the timeline, not the matrix
basics
~20 sNo. ATT&CK's tactic columns are goal categories, not stages. An intrusion can re-enter one column repeatedly, never touch several of them, and hit them in any order. The Cyber Kill Chain is the model that asserts order; ATT&CK's columns do not.
solid answer
~40 sNo — the columns classify *intent*, not time. Each column (Initial Access, Discovery, Persistence, Exfiltration, Impact and the rest) names a goal an operator can hold at any moment, so one episode can re-enter Discovery three times, never reach Persistence at all, and land on Impact before anything is exfiltrated. The left-to-right layout is a readability convention that happens to trace a loosely typical intrusion, which is exactly why people read it as a pipeline. The Cyber Kill Chain is the model that genuinely claims order — seven stages, each depending on the one before. When you tag an observed action with a tactic you are saying 'this is what the operator was trying to achieve here'; the sequence comes from your own timeline, not from the matrix.
go deeper
Be ready to say plainly that ATT&CK tactic columns are goal categories and carry no sequence, and that the Cyber Kill Chain is the model that does. Have one concrete example of a tactic repeating or being absent.
An interviewer expects you to explain why the printed layout is only a convention, and to show where sequence actually comes from — the moments attached to the observed actions, not the grid.
Demonstrate that you can stop a team from encoding a false order: no single phase number per intrusion, and no inference that 'further right' means worse. Show you know which instrument answers which question.
Own the choice of instrument across an organisation. Ordered stages support arguments about dependent sequences; unordered goal columns support describing what an operator wanted at each moment. Picking one for both purposes is where narration quietly turns into fiction.
## Two models, and only one of them asserts order The confusion this question tests is one of the most common in the whole vocabulary: people meet ATT&CK as a wall-sized grid, see columns running left to right, and conclude that an intrusion walks across it. It does not, and the model never said it did. ### What a tactic column actually is In ATT&CK, a **tactic** is a goal category — the answer to 'what was the operator trying to accomplish with this action?'. Initial Access is the goal of getting in. Discovery is the goal of learning about the environment. Persistence is the goal of keeping access across an interruption. Exfiltration is the goal of getting data out. Impact is the goal of degrading, destroying or defacing something. Underneath each column sit **techniques** — the ways that goal gets achieved — each with a `T####` identifier. Nothing in that structure is temporal. A column is a bucket you drop an observed action into, and buckets have no order among themselves. ### Why the layout fools people The Enterprise matrix is drawn with the columns in a fixed printed sequence that begins with the pre-intrusion goals and ends with Exfiltration and then Impact. That sequence traces a plausible story — get in, look around, take things, break things — so a reader naturally infers a pipeline. It is a navigation aid: it makes a column findable and gives a newcomer a mental hook. It is not a claim. The giveaway is how real episodes behave. Consider a publicity-driven defacement of a public-facing web estate. The operator exploits a public-facing application, looks around, finds which template files are writable, checks which pages are served from an edge cache, and replaces the front page. Tagged by tactic, that is Initial Access, then Discovery, then Discovery again, then Discovery a third time, then Impact — with no Persistence and no Exfiltration anywhere. Every one of those tags is correct. The episode simply did not walk the grid. ### The model that does assert order The Lockheed Martin Cyber Kill Chain is the ordered one: seven stages running from reconnaissance through delivery and installation to actions on objectives, each stage presupposing the one before it. That ordering is the whole point of that model — it exists so you can argue about which link to break. ATT&CK made the opposite design choice deliberately: it describes what was observed, whatever order it arrived in, so that behaviours can be catalogued without forcing every intrusion into one narrative shape. So when someone says 'the frameworks disagree', they usually mean they have flattened two different instruments into one. They answer different questions. ### Where the ordering really lives If the matrix does not carry sequence, something has to. It is your reconstructed timeline: each observed action has a moment, and the moments put the actions in order. The tactic tag says *why*; the clock says *when*. A useful test: swap ATT&CK for any other goal taxonomy and the order of the episode does not change at all. That is the proof the order was never coming from the matrix. This is why an episode cannot be stored as a single ordered phase number. 'Phase 4 of 7' assumes exactly one visit per stage and no skipping. An episode that re-enters Discovery three times and never reaches Persistence has no such number — any value you pick either overstates what the operator did or hides that they already finished. ### The two mistakes to avoid The first is treating the columns as steps. It produces the belief that a tactic can appear only once, that a missing tactic means something went wrong with the account, or that being 'further right' means the intrusion got worse. The second is over-correcting into 'the models are interchangeable'. They are not. Ordered stages are the right instrument when you want to reason about a sequence with dependencies; unordered goal columns are the right instrument when you want to say, moment by moment, what an operator was trying to achieve. Knowing which question you are answering is the skill being tested.
- If the columns are not ordered, why are they drawn left to right at all?Because the layout is a readability convention that follows a loosely typical progression — getting in on the left, effects on the right. It makes a column findable for a newcomer, and it is precisely why the pipeline misreading is so common. Nothing in the model requires an operator to traverse the columns, or to traverse any of them once.
- If the matrix does not supply the sequence, what does?Your own reconstruction. Each observed action has a moment attached, and those moments order the episode; the tactic tag only says what the operator was trying to achieve at each one. Swap ATT&CK for a different goal taxonomy and the sequence is unchanged — which shows the order never came from the grid.
Supermarket aisle signs group what you can buy; they do not tell you the order to shop in. You can walk the same aisle four times and never enter another one.
saying these in an interview costs you the question
- Reads the columns left to right as a timeline
- Assumes every intrusion visits every tactic
- Thinks a tactic can appear only once per intrusion
- Treats ATT&CK as the Kill Chain with more boxes
- Says an intrusion with no Persistence must be incomplete