ATT&CK, Kill Chain and TTPs

No. It interdicts paths that need those two links and says nothing about paths that need neither. A bought remote-access credential traverses no delivery and no exploit, so both claims are true and the chain still completes.

No. The mitigations section is an unordered list of general control classes, not a specification and not a completeness claim. Some techniques carry an explicit note that preventive controls cannot mitigate them, because they abuse legitimate functionality.

Defense Evasion names a goal an operator spends effort on: steps taken specifically to avoid or degrade controls. Being inconspicuous by accident is not Defense Evasion. Used as an adjective, the column tags everything and stops naming a choice.

It decouples the two. The broker traverses Reconnaissance through Exploitation once and sells the result many times, so interdicting those links taxes the broker's amortised production cost, while the buyer's entry cost is only a listing price.

It measures the accounts, not the intrusion: how much each author could see, how much they chose to write, how far each mapper inferred, and how much of each text was behaviour at all. It says nothing about adversary sophistication.

It promotes a thinly evidenced technique over a heavily evidenced one. A host trusted for unconstrained delegation caches the Kerberos ticket of whatever authenticates to it, so coercing a privileged account there reaches the directory in one step.

The pyramid assumes bottom-rung values are by-products a crew regenerates for free. A stolen code-signing key is a scarce asset carrying vendor trust - burning it costs more than every domain they own. The ordering inverts at the bottom.

Do both, selectively. Migrate mechanically resolvable identifiers on a schedule and keep the originals, never back-fill granularity nobody recorded, and stamp every mapping with its release. Pinning forever fails because everyone else moves.

Both, scoped per asset group rather than per estate: Enterprise for the office hosts, ICS for the controllers. The decision matters because naming a matrix names which adversary goals are in scope, and therefore whose budget owns the gap between them.

State the claim in the adversary's currency: say which procedures are closed, what respelling costs the operator, and that the technique class remains open. Never let a procedure-shaped item close a technique-shaped one, even under schedule pressure.

No, as a universal score. An ordinal assumes every episode traverses the same stages once, in order, so it is undefined for one that repeats a goal and skips several. Offer instead: objective reached or not, which goals were observed, and time to that point.

Usually yes, but not as an engineer acting alone and not as a conclusion. The call needs an owner inside your organisation, and what you hand over is the dated artefact and the narrow edge, never a verdict about the other company's estate.

No honest identifier exists: the catalogue records behaviour and goals, never permission. Negotiate the form rather than the fact - offer a plain description, map only a genuinely technical step, and ask that the field accept a written reason.