Cyber Resilience

← ISO 27001 Annex A

A.6.3 People

Information security awareness, education and training

AttributesPreventive C·I·A Protect Human resource security Governance and Ecosystem

Structured attributes from ISO/IEC 27002:2022 — control type · CIA properties · cybersecurity concept · operational capability · security domain. What do these mean?

The implementation guidance for this control is published in ISO/IEC 27002:2022 and is not reproduced here. The structured attributes and the cross-walk rationales below are derived facts and our own AI-authored analysis.

Mapped NIST 800-53 r5 controls (15)

Our AI-authored reading (authority llm_unverified, under review) of how this ISO control and each NIST 800-53 control relate. Not an ISO or NIST product.

Direction: ← other covers this; → this covers other (F/M/P = full / mostly / partial). gov = governs / implements (a mandate, not coverage).

AT-1←P AT-2←M →F AT-3←M →F AT-4←P AT-6←M PL-4←P

Why these map — AI rationale (under review)

AT-2fullcovers — The ISO control establishes a recurring, role-aware awareness program that directly fulfills the intent of AT-2 to ensure all users understand their security responsibilities.
AT-3fullcovers — By requiring targeted training for technical teams and skill-gap remediation, the ISO control satisfies AT-3’s mandate for role-based training aligned with job functions.
AT-4mostlyaligns with — The ISO control’s requirement to assess understanding after each activity supports the record-keeping and effectiveness-tracking objectives of AT-4.
PM-13partialaligns with — The ISO control’s emphasis on building and maintaining technical security skills across the workforce contributes to the broader workforce-development goal of PM-13.
AT-4covers — Assessed as NOT holding by the authoring instrument at v1.22-2026-08-29. This row records a tested non-relation; it is not a graded claim and carries no rationale, because the instrument produced none when the verb did not hold.
PM-13covers — Assessed as NOT holding by the authoring instrument at v1.22-2026-08-29. This row records a tested non-relation; it is not a graded claim and carries no rationale, because the instrument produced none when the verb did not hold.

Aligned NIST CSF 2.0 outcomes (9)

NIST CSF 2.0 outcomes this ISO control aligns with — our AI-authored analysis (authority llm_unverified, under review).

Direction: ← other covers this; → this covers other (F/M/P = full / mostly / partial). gov = governs / implements (a mandate, not coverage).

GV.RR-04→P ID.IM-01gov PR.AT-01gov PR.AT-02gov

Why these map — AI rationale (under review)

GV.RR-04mostlyaligns with — By embedding security awareness, education, and training into human-resources practices for new and transferring personnel, the ISO control supports the CSF outcome of integrating cybersecurity into HR processes.
GV.RR-04partialcovers — A.6.3's focus on awareness/education/training to fulfill security responsibilities accounts for the bulk of including cybersecurity in HR practices (onboarding, role-specific training, ongoing awareness), but leaves a residual of other HR practices (hiring screening, disciplinary processes, offboarding) that the control does not address.
ID.IM-01partialaligns with — The ISO control mandates post-activity assessments of personnel understanding and uses lessons learned from incidents to refine the programme, contributing to the CSF outcome of identifying improvements from evaluations.
PR.AT-01noneimplements — The ISO control establishes and operates a recurring awareness programme that ensures all personnel understand their security responsibilities and baseline controls, directly satisfying the CSF outcome of providing general awareness and training.
PR.AT-02noneimplements — The ISO control requires a targeted education and training plan for technical teams that need specialized skills, matching the CSF outcome of equipping individuals in specialized roles with the necessary knowledge and skills.
ID.IM-01implements — Assessed as NOT holding by the authoring instrument at v1.22-2026-08-29. This row records a tested non-relation; it is not a graded claim and carries no rationale, because the instrument produced none when the verb did not hold.
ID.IM-01implements — Assessed as NOT holding by the authoring instrument at v1.22-2026-08-29. This row records a tested non-relation; it is not a graded claim and carries no rationale, because the instrument produced none when the verb did not hold.

Related weaknesses / CWE (9)

Weakness classes this ISO control helps prevent or mitigate — our AI-authored analysis (authority llm_unverified, under review).

Direction: ← other covers this; → this covers other (F/M/P = full / mostly / partial). gov = governs / implements (a mandate, not coverage).

CWE-200→P CWE-284→P CWE-356→P CWE-451←P →P CWE-522→P CWE-676→P CWE-732→P CWE-798→P

Why these map — AI rationale (under review)

CWE-200prevents — Awareness of data-handling obligations and incident-reporting procedures reduces the chance that staff will inadvertently disclose sensitive information.
CWE-284prevents — Personnel who understand their responsibilities and the baseline controls they must follow are less likely to grant or exercise access rights beyond what policy permits.
CWE-356prevents — Security awareness training can teach users to heed or demand warnings for unsafe actions.
CWE-451prevents — Security awareness training can teach users to recognize UI misrepresentation and phishing attempts.
CWE-522prevents — Regular reminders about password security and personal accountability make users less likely to store or transmit credentials in cleartext or other unprotected forms.
CWE-676prevents — Developer security awareness training can teach safe alternatives to risky functions.
CWE-732prevents — Training on baseline controls and policy compliance helps staff avoid assigning overly permissive file or resource permissions that expose assets to unauthorized actors.
CWE-798prevents — Education on secure configuration practices discourages technical staff from embedding or relying on hard-coded credentials in systems and applications.

Mitigated MITRE ATT&CK techniques (511)

Adversary techniques (MITRE ATT&CK Enterprise) this ISO control helps mitigate; links open attack.mitre.org. Our AI-authored analysis (authority llm_unverified, under review).

Direction: ← other covers this; → this covers other (F/M/P = full / mostly / partial). gov = governs / implements (a mandate, not coverage).

T1001←M T1001.001←M T1001.002←M T1001.003←M T1003→P T1003.001→P T1003.002→P T1003.003→P T1003.005→P T1003.006→P T1003.008→P T1006←M T1014←M T1016.002→P T1021→P T1021.001→P T1021.004→P T1021.005→P T1021.006→P T1021.007→P T1021.008→P T1027→P T1027.001←M T1027.002←M T1027.005←M T1027.006←M T1027.007←M T1027.008←M T1027.009←M T1027.010←M →P T1027.011←M T1027.014←M T1027.015→P T1027.016←M T1027.017→P T1027.018←M →P T1030←M T1036←M →P T1036.002→P T1036.003←M T1036.005←M T1036.006←M →P T1036.007←M →P T1036.008←M →P T1036.009←M T1036.010→P T1036.012←M T1037→P T1037.001→P T1037.002→P T1037.003→P T1037.004→P T1037.005→P T1040→P T1047→P T1048→P T1052→P T1052.001→P T1055←M T1055.001←M T1055.002←M T1055.003←M →P T1055.004←M T1055.005←M T1055.008←M T1055.009←M T1055.011←M T1055.012←M T1055.013←M T1055.014←M T1055.015←M T1056→P T1056.001→P T1056.002→P T1057→P T1059→P T1059.001→P T1059.002→P T1059.003→P T1059.004→P T1059.005→P T1059.006→P T1059.007→P T1059.008→P T1059.010→P T1059.013→P T1068←M →P T1069→P T1069.003→P T1070←M T1070.008→P T1070.010←M T1071←M T1071.001←M T1071.004←M T1072→P T1078→P T1078.001←P →P T1078.002→P T1078.003→P T1078.004→P T1080→P T1087.003→P T1087.004→P T1090←M T1090.002←M T1090.003←M T1090.004←M T1091→P T1095←M T1098→P T1098.001→P T1098.002→P T1098.003→P T1098.004→P T1098.005←M →P T1098.006→P T1098.007→P T1102←M T1110→P T1110.001→M T1110.002→P T1110.003→P T1110.004→P T1111←M →P T1114→P T1114.002→P T1114.003→P T1127←M T1127.001←M →P T1127.002→P T1127.003←P T1132←M T1132.001←M T1132.002←M T1133←M →P T1134←M T1134.003←M T1134.004←M T1136→P T1136.003→P T1137→P T1137.001→P T1137.002→P T1137.003→P T1137.004→P T1137.005→P T1137.006→P T1140→P T1176→P T1176.001→P T1176.002→P T1185←M →P T1187→P T1189→P T1190→P T1195→P T1195.001→P T1199→P T1201→P T1202←M T1203←P →P T1204→P T1204.001→P T1204.002→P T1204.003←P →P T1204.004→P T1204.005←P →P T1205.002→P T1207←M T1210→P T1211←M T1212→P T1213→P T1213.001→P T1213.002→P T1213.003→P T1213.005→P T1216←M T1218←M T1218.001→P T1218.002→P T1218.005←M →P T1218.007←M T1218.008←M T1218.010←M T1218.011←M T1218.013←M T1219→P T1219.001→P T1219.002→P T1221←M →P T1222←M T1222.001←M →P T1222.002←M T1480.001←M T1484←M T1484.001→P T1484.002←M T1485→P T1486→M T1491.001→P T1496→P T1496.001→P T1496.002→P T1496.004→P T1497←M T1499→P T1505.003→P T1518.001→P T1528→P T1530→P T1531→P T1534→P T1535←M T1537←M T1538→P T1539←F →P T1542←M T1542.002←M T1543.002→P T1543.003→P T1543.005→P T1546→P T1546.001→P T1546.003→P T1546.004→P T1546.012←P →P T1546.013→P T1546.015→P T1546.016→P T1547.001→P T1547.003→P T1547.004→P T1547.006→P T1547.007→P T1547.012→P T1547.015→P T1548.002←M →P T1548.003→P T1548.004→P T1548.005→P T1548.006←M →P T1550←M →P T1550.001←F →P T1550.002←F T1550.003←F T1550.004←F →P T1552.001→P T1552.003→P T1552.004→P T1552.006→P T1552.007→P T1552.008→P T1553→P T1553.001←M T1553.002←P T1553.003←M T1553.004←M →P T1553.005←M T1553.006←M →P T1555→P T1555.003→P T1555.005→P T1556←M T1556.001←M T1556.005→P T1556.006←M T1556.007←M →P T1556.008→P T1556.009←M →P T1557.001→P T1557.004←P →P T1558→P T1558.003→P T1558.004→P T1558.005→P T1559.002→P T1563→P T1563.001→P T1564←M T1564.002→P T1564.003→P T1564.004←M T1565→P T1566→P T1566.001→P T1566.002→P T1566.003→P T1566.004→P T1567→P T1567.003→P T1567.004→P T1568←M T1571←M T1572←M T1574←M →P T1574.001←M →P T1574.004←M T1574.005→P T1574.006→P T1574.008→P T1574.009→P T1574.011→P T1574.013←M T1578←M T1578.001←M T1578.002←M T1578.003←M T1578.004←M T1578.005←M T1583.001→P T1583.008→P T1584.001→P T1585.001←M T1586→P T1586.001→P T1586.002←P →P T1586.003→P T1588.005→P T1588.007→P T1589→P T1589.001→P T1589.003→P T1590.003→P T1591→P T1591.002→P T1591.003→P T1591.004→P T1593→P T1593.001→P T1593.002→P T1593.003→P T1598→M T1598.001→P T1598.002→P T1598.003→P T1598.004→P T1599←M →P T1599.001←M T1601.002←M T1602.001→P T1606.001←F T1606.002←M T1608.004→P T1608.005←P →P T1612←P T1620←M T1621→P T1647←P T1649→P T1653←P T1657→P T1666←M T1667→P T1671→P T1677→P T1678←M T1683←M →P T1683.001←M →P T1683.002←M →P T1684→P T1684.001→P T1684.002←M →P T1685←M →P T1685.001←M →P T1685.002←M →P T1685.003←M T1685.004←M T1685.005←M T1686←F T1686.003←M T1688←M

Why these map — AI rationale (under review)

T1003prevents — awareness, education and training on responsibilities, incident lessons, basic procedures (e.g. event reporting) and baseline controls (e.g. password security) can stop some credential-dumping techniques from being attempted or succeeding, but leaves the dominant technical methods (memory scraping, LSASS access, keychain dumping) untouched
T1003.001prevents — awareness, education and training on responsibilities, incident lessons, baseline controls (e.g. password security) and secure configuration can stop some LSASS dumping vectors (especially SSP registry changes or poor credential hygiene) but leaves the dominant in-memory dumping techniques by admin/SYSTEM untouched
T1003.002prevents — awareness, education and training on responsibilities, incident lessons, password security and event reporting can reduce the chance an insider enables or performs SAM extraction, but does not stop a SYSTEM-level adversary technique once privileges are obtained
T1003.003prevents — awareness, education and training on responsibilities, incident lessons, password security, event reporting and technical skills can reduce the likelihood an insider or poorly trained admin enables or performs this credential-access technique, but does not stop a determined adversary who already has the needed privileges or exploits a misconfiguration
T1003.005prevents — awareness, education and training on responsibilities, baseline controls (e.g. password security), incident lessons, and technical skills for maintaining security configurations can reduce the likelihood that cached domain credential stores are left accessible or extractable, but does not stop the technique when an adversary already has SYSTEM/sudo access
T1003.006prevents — awareness/education/training on responsibilities, policies, incident lessons, password security and event reporting lowers the chance privileged users will enable or overlook the DCSync prerequisites (e.g. excessive group membership, poor credential hygiene), but does not stop the technique itself once those privileges exist
T1003.008prevents — awareness, education and training on responsibilities, password security, incident reporting and role-specific technical skills can stop some personnel from enabling or performing this technique, but cannot prevent a privileged adversary (or malware) that already has root or equivalent access from dumping the files
T1016.002prevents — awareness, education and training on responsibilities, baseline controls (e.g. password security) and incident lessons can reduce the chance an insider or user action enables the initial compromise that lets the technique run, but does not stop a post-compromise adversary from executing discovery commands on a Linux/Windows/macOS host
T1021prevents — awareness, education and training on responsibilities, policies, incident lessons, password security and basic procedures can stop some misuse of valid accounts for remote service logins (e.g. via better credential hygiene or not falling for phishing), but leaves the dominant technical vectors (credential theft, domain compromise, protocol abuse) untouched
T1021.001prevents — awareness, education and training on responsibilities, policies, password security, incident reporting and technical configuration skills lowers the chance that valid accounts are obtained or that RDP is left enabled/accessible, but does not stop the technique when credentials already exist or misconfigurations remain
T1021.004prevents — awareness, education and training on responsibilities, baseline controls (e.g. password security), incident lessons, and technical skills can reduce the likelihood of credential compromise or SSH misconfiguration that enables the technique, but does not stop an adversary who already holds valid accounts from using them
T1021.005prevents — awareness, education and training on responsibilities, baseline controls (e.g. password security), incident lessons, and technical configuration skills can stop some valid-account VNC abuse and misconfigurations but leaves the dominant technique (using already-compromised legitimate credentials) untouched
T1021.006prevents — awareness/education/training on responsibilities, policy compliance, incident lessons, basic procedures (e.g. event reporting) and password security lowers the chance valid accounts are obtained or misused via WinRM, but does not stop the technique when accounts are already compromised or when technical configuration gaps remain
T1021.007prevents — awareness, education and training on responsibilities, policies, incident lessons, password security, and technical skills for maintaining security configurations can reduce the likelihood of credential compromise or misconfiguration that enables T1021.007, but does not stop the technique when valid accounts are already available
T1021.008prevents — awareness, education and training on responsibilities, baseline controls (e.g. password security, event reporting) and lessons from incidents can reduce the likelihood of credential compromise or misuse that enables this technique, but does not stop the technique itself when valid accounts or misconfigurations already exist
T1027prevents — awareness/training on responsibilities, baseline controls (e.g. password security), and recognizing/reporting suspicious content or events can stop users from opening or executing obfuscated payloads that require user action, but does not stop adversary obfuscation techniques themselves or non-user-triggered cases
T1027.010prevents — awareness, education and training on responsibilities, baseline controls (e.g. password security), incident lessons, and technical skills can reduce the likelihood that personnel (or supplied personnel) will introduce or tolerate command obfuscation in delivered payloads, scripts, or interactive interpreters, but does not stop adversaries from using it themselves
T1027.015prevents — awareness/education/training on responsibilities, baseline controls (e.g. password security), incident lessons, and recognizing suspicious attachments or self-extracting archives can stop users from extracting/launching compressed malicious payloads, but cannot stop adversary-side compression, concatenation, or fileless registry techniques
T1027.017prevents — awareness training on responsibilities, policy compliance, basic procedures (e.g. event reporting), and recognizing suspicious content can reduce the likelihood users introduce or fall for SVG-smuggled payloads, but does not stop adversaries from crafting or delivering the technique itself
T1027.018prevents — awareness/education/training on responsibilities, baseline controls (e.g. password security), and lessons from incidents can reduce the likelihood that personnel introduce or overlook invisible Unicode concealment in scripts/files they create or review, but does not stop adversaries from applying the technique
T1036prevents — awareness/education/training on responsibilities, baseline controls (e.g. password security), and lessons from incidents can reduce the likelihood that users or admins fall for or enable masquerading tricks, but does not stop adversaries from performing the technique itself
T1036.002prevents — awareness training on recognizing social-engineering tricks, anomalous file names, and basic security procedures (including lessons from incidents) lowers the chance users or defenders will be fooled by an RTLO disguise and execute the file, but does not stop the adversary from embedding the character or remove the technique itself
T1036.006prevents — awareness training on basic procedures, personal accountability, and recognizing suspicious file behaviors (built on incident lessons) can stop users from double-clicking the disguised executable, but does not remove the OS-level technique itself
T1036.007prevents — awareness training on recognizing social-engineering lures, email attachments, and basic security procedures (including file-type risks) lowers the chance users will open a double-extension payload, but does not stop the technique from being executed or the file from being delivered
T1036.008prevents — awareness/education/training on responsibilities, baseline controls (e.g. password security), incident lessons, and technical skills for secure configuration can reduce the chance users or admins introduce or accept masqueraded files, but does not stop adversaries from performing the technique itself
T1036.010prevents — awareness/training on responsibilities, policy compliance, basic procedures and recognizing suspicious account activity (built on incident lessons) can stop personnel from accepting/using the masqueraded account, but does not stop the adversary technique of creating or renaming it
T1037prevents — awareness/education/training on responsibilities, procedures and baseline controls (e.g. password security, event reporting) can stop personnel from introducing or tolerating malicious boot/logon scripts, but does not stop an already-privileged adversary from deploying them
T1037.001prevents — awareness/education/training on responsibilities, baseline controls (e.g. password security) and incident lessons can reduce the chance users/admins introduce or tolerate malicious logon scripts, but does not stop the registry modification technique itself
T1037.002prevents — awareness/education/training on responsibilities, baseline controls (e.g. password security), and incident lessons can reduce the chance an authorized admin introduces or tolerates a malicious login hook, but does not stop the technique itself
T1037.003prevents — awareness/education/training on responsibilities, policies, incident lessons, and baseline procedures (incl. event reporting) can stop users/admins from deploying or tolerating malicious logon scripts, but does not block the technique when an adversary already has the necessary privileges to set the script via AD/GPO
T1037.004prevents — awareness/education/training on responsibilities, baseline controls (e.g. password security), and incident lessons can reduce the odds an authorized insider (admin) introduces a malicious RC modification, but does not stop the root-privilege technique itself or block non-malicious misconfigurations
T1037.005prevents — awareness/education/training on responsibilities, baseline controls (e.g. password security), and incident lessons can reduce the chance an insider or admin introduces or tolerates a malicious startup item, but does not stop an adversary who already has the privileges to create the required files at /Library/StartupItems
T1040prevents — awareness, education and training on responsibilities, baseline controls (e.g. password security, event reporting) and lessons from incidents can prevent the insecure unencrypted protocols and misconfigurations that make sniffed credentials or configuration data useful, but does not stop the passive capture technique itself on any listed platform
T1047prevents — awareness/education/training on responsibilities, baseline controls (e.g. password security), and incident lessons can reduce the likelihood that personnel enable or fail to block WMI abuse, but does not stop a determined adversary from abusing the built-in feature via scripting or APIs
T1048prevents — awareness/education/training on responsibilities, baseline controls (e.g. password security, event reporting), and policy compliance can lower the chance an insider enables or performs this exfiltration technique, but does not stop the code-level or configuration defect that permits it
T1052prevents — awareness/training on responsibilities, baseline controls (e.g. 5.17 password security), incident lessons, and physical-medium handling reduces the chance users will introduce or use removable media for exfiltration, but does not stop a determined adversary or remove the technique's feasibility in air-gapped scenarios
T1052.001prevents — awareness/training on responsibilities, incident lessons, basic procedures (e.g. event reporting) and baseline controls (e.g. password security) can reduce the likelihood of users introducing USB devices for exfiltration in air-gapped scenarios, but does not stop a determined adversary or technically capable insider from using removable media
T1055.003prevents — awareness, education and training on responsibilities, procedures, incident lessons, and secure configuration skills can reduce the likelihood that personnel (or suppliers) will introduce or permit the conditions that enable thread execution hijacking, but does not stop a determined adversary from performing the technique
T1056prevents — awareness training on responsibilities, basic procedures (e.g. event reporting, password security), and recognizing deceptive input prompts lowers the chance users fall for phishing-style or social-engineering slices of input capture, but cannot stop transparent technical mechanisms such as API hooking or keyloggers that require no user action or awareness
T1056.001prevents — awareness/education/training on responsibilities, procedures (e.g. event reporting, password security) and lessons from incidents can prevent some user behaviors that enable keylogging (e.g. falling for delivery vectors or failing to report anomalies), but does not stop the technical implementation methods (API hooks, drivers, registry mods, hardware reads) once the adversary is on the system
T1056.002prevents — awareness training on recognizing spoofed credential prompts, reporting suspicious dialogs, and understanding personal accountability lowers the chance users will fall for the mimicked GUI technique, but does not stop adversaries from executing it
T1057prevents — awareness/training on responsibilities, baseline controls (e.g. password security, event reporting) and lessons from incidents can reduce the likelihood an insider or social-engineered user enables or performs process discovery, but does not stop an external adversary from executing the technique via cmd, PowerShell, ps, /proc or native APIs once initial access is obtained
T1059prevents — awareness/education/training on responsibilities, baseline controls (e.g. password security), and lessons from incidents can constrain some abuse of interpreters (e.g. via policy-mandated restrictions or reduced social-engineering success) but leaves the dominant technical abuse surface (built-in interpreters required by the platform) untouched, matching the cm-7 vs T1059 anchor
T1059.001prevents — awareness/education/training on responsibilities, baseline controls (e.g. password security), and lessons from incidents can reduce the likelihood that personnel enable or introduce opportunities for PowerShell abuse, but does not stop the technique itself when an adversary (or compromised account) runs it
T1059.002prevents — awareness/education/training on responsibilities, baseline controls (e.g. password security), incident lessons, and technical skills can reduce the likelihood that users or admins enable or fall for AppleScript abuse vectors (e.g. via social engineering, misconfigured Mail/Automator rules, or unpatched execution paths), but cannot stop an adversary who already has code execution from directly invoking osascript/NSAppleScript
T1059.003prevents — awareness, education and training on responsibilities, baseline controls (e.g. password security), incident lessons, and technical skills can stop some misuse of cmd.exe (especially by insiders or via poor configs) but leaves the dominant adversary-abuse path (post-compromise remote/local execution with legitimate privileges) untouched
T1059.004prevents — awareness/education/training on responsibilities, baseline controls (e.g. password security), and lessons from incidents can reduce the likelihood that users/admins enable or invoke Unix shell abuse, but does not stop an adversary who already has a foothold from abusing the shell
T1059.005prevents — awareness/education/training on responsibilities, policies, basic procedures (e.g. event reporting, password security) and lessons from incidents can reduce the likelihood that users enable or execute malicious VB/VBA/VBScript payloads (e.g. via macros or attachments), but does not stop adversaries from abusing the technique in code or automated behaviors
T1059.006prevents — awareness/education/training on responsibilities, baseline controls (e.g. password security) and secure procedures lowers the chance that personnel will write, allow or run malicious Python scripts, but does not stop an adversary-introduced interpreter or compiled binary from executing
T1059.007prevents — awareness, education and training on responsibilities, baseline controls (e.g. password security), incident lessons, and technical skills for secure configuration can reduce the likelihood that personnel introduce or allow environments enabling JavaScript abuse (e.g. via unsafe scripting, unpatched runtimes, or drive-by vectors), but does not stop adversaries from abusing JS implementations directly
T1059.008prevents — awareness/education/training on responsibilities, baseline controls (e.g. password security), and secure configuration skills for technical teams lowers the chance that legitimate access is abused or that devices are left in a state where CLI abuse is possible, but does not stop an adversary who already has CLI access from using it
T1059.010prevents — awareness, education and training on responsibilities, baseline controls (e.g. password security), incident reporting, and technical skills can reduce the likelihood that users or admins introduce, allow, or fail to detect AHK/AutoIT abuse, but does not stop adversaries from bringing or compiling the scripts themselves
T1059.013prevents — awareness/education/training on responsibilities, baseline controls (e.g. password security), and incident lessons can reduce the chance that authorized users introduce or enable the CLI/API abuse, but does not stop a determined adversary who already has the necessary access or privileges
T1068prevents — awareness, education and training on responsibilities, procedures, and secure configuration can reduce the chance that vulnerable software/drivers are introduced or left exploitable, but does not stop adversaries from exploiting already-present vulnerabilities in OS components or third-party software
T1069prevents — awareness/training on responsibilities, policy compliance, incident lessons, and basic procedures (incl. password security) lowers the chance users will enable or expose permission groups that adversaries can discover, but does not stop the discovery technique itself once an account is compromised
T1069.003prevents — awareness, education and training on responsibilities, policies, incident lessons, and baseline controls (e.g. password security, event reporting) can reduce the chance an insider or compromised account performs or enables the discovery technique, but does not stop an already-authenticated adversary from running the listed tools/APIs
T1070.008prevents — awareness, education and training on responsibilities, incident reporting, baseline controls and lessons from incidents can stop some users/admins from running mailbox-clearing commands or transport rules, but cannot stop all adversary techniques (especially automated or privileged ones) on all platforms
T1072prevents — awareness, education and training on responsibilities, baseline controls (e.g. password security), incident lessons, and technical skills for secure configuration/maintenance can stop some misuse of deployment tools by reducing credential compromise, misconfiguration, or failure to follow policy, but leaves the dominant technical access/abuse vector (admin accounts, integration into CI/CD, direct exploitation) untouched
T1078prevents — awareness/education/training on responsibilities, policy compliance, password security, incident reporting and technical configuration skills lowers the chance personnel will create, share, or leave exploitable accounts (including inactive ones), but cannot stop external compromise, phishing, or credential theft that still enables the technique
T1078.001prevents — awareness/education/training on responsibilities, baseline controls (e.g. password security), and changing defaults lowers the chance personnel will leave default accounts unchanged or easily guessable, but does not guarantee they will be altered on all systems/devices (especially unmanaged, third-party, or post-integration defaults like vpxuser)
T1078.002prevents — awareness/education/training on responsibilities, policy compliance, password security, and incident reporting lowers the chance personnel will introduce or allow the credential-compromise vectors named in the technique (reuse, weak passwords, failure to report dumping), but cannot stop an already-compromised account from being abused or an external dump from succeeding
T1078.003prevents — awareness, education and training on responsibilities, password security, incident reporting and technical skills can stop some local-account abuse (e.g. weak/reused passwords, poor credential hygiene) but cannot prevent all vectors such as OS credential dumping, misconfigured service accounts or already-compromised credentials
T1078.004prevents — awareness, education and training on responsibilities, policies, procedures, incident lessons, password security, MFA implications and secure configuration lowers the chance that personnel introduce or fall for the account-compromise vectors named in the technique, but does not stop the class from arising via misconfigurations, technical flaws or external supply-chain compromise
T1080prevents — awareness/training on responsibilities, incident lessons, basic procedures (e.g. event reporting, password security) and management commitment can reduce the chance users introduce or execute tainted shared content, but does not stop adversaries from adding it to shares or repositories
T1087.003prevents — awareness/education/training on responsibilities, policies, incident lessons, and baseline procedures (e.g. event reporting) can prevent the authenticated session or misuse that enables T1087.003, but leaves technical gaps such as misconfigured Exchange/Outlook permissions or unaddressed skill deficits in technical teams
T1087.004prevents — awareness, education and training on responsibilities, policies, procedures and baseline controls (e.g. password security, event reporting) can stop personnel from supplying the authenticated access the technique requires, but cannot stop an already-authenticated adversary or misconfigured service principal from enumerating accounts
T1091prevents — awareness/training on responsibilities, basic procedures (e.g. event reporting, password security), and lessons from incidents can reduce user execution of malicious removable media but does not stop the technique's core vectors such as Autorun, firmware modification, or air-gapped lateral movement
T1098prevents — awareness, education and training on responsibilities, policies, password security, incident reporting and technical configuration skills lowers the chance that personnel will perform or allow the account manipulations described (e.g. weak credential hygiene, permission-group errors, subverting duration policies), but cannot stop an already-privileged adversary who chooses to execute them
T1098.001prevents — awareness, education and training on responsibilities, policies, incident lessons, password security and event reporting can stop some insider or privilege-abusing additions of credentials but does not stop an already-compromised administrator or external adversary who already possesses sufficient permissions from executing the technique
T1098.002prevents — awareness/education/training on responsibilities, policy compliance, incident lessons, and basic procedures (incl. event reporting) can prevent users/admins from unwittingly or negligently granting the extra mailbox/folder permissions the technique relies on, but does not stop a determined adversary who already controls an account or bypasses human factors
T1098.003prevents — awareness/education/training on responsibilities, policy compliance, incident lessons, and technical skills (incl. IAM configuration) lowers the chance personnel will perform or allow the account/role modifications the technique requires, but does not stop a determined adversary who already holds sufficient permissions
T1098.004prevents — awareness, education and training on responsibilities, baseline controls (e.g. password security), incident lessons, and secure configuration skills can stop some SSH authorized_keys modifications (especially by insiders or via misconfigurations), but leaves the dominant adversary technique (direct file or API modification post-compromise) untouched
T1098.005prevents — awareness, education and training on MFA responsibilities, device enrollment rules, and recognizing anomalous registration can stop credential-compromised or post-access adversaries from successfully registering devices, but only reaches the human-factors slice of the technique (e.g. self-enrollment bypasses, policy violations) while leaving technical enrollment paths, automated abuse, and non-human vectors untouched
T1098.006prevents — awareness, education and training on responsibilities, policies, incident lessons, and secure configuration skills can stop personnel (including technical teams) from granting the extra roles/permissions the technique requires, but does not block a compromised privileged account or direct adversary action
T1098.007prevents — awareness, education and training on responsibilities, baseline controls (e.g. password security, event reporting) and lessons from incidents can lower the chance an insider or compromised account performs or enables this persistence technique, but does not stop a determined adversary who already controls an account from issuing net localgroup/usermod commands
T1110prevents — awareness/training on password security, personal accountability, and compliance with rules lowers the chance users choose weak/reused passwords or expose hashes, making brute-force less viable, but does not stop the technique when strong passwords are still guessable, when hashes are already obtained, or when MFA/lockouts are absent
T1110.001detects — A.6.3 awareness/education/training can surface knowledge of anomalous login patterns or failed attempts as part of incident reporting training, but the control itself only builds awareness and does not instrument, monitor or surface the guessing technique in flight
T1110.001prevents — awareness, education and training on password security, account lockout policies, and responsibilities directly lowers the success odds of password guessing by making both users and technical teams implement stronger baselines and configurations that stop the technique from succeeding
T1110.002prevents — A.6.3's awareness/education on password security, personal accountability, compliance with rules, and incident lessons directly lowers the chance users choose crackable passwords or mishandle credentials, preventing the technique at its root for the bulk of human-factor cases (per A.8.5 anchor); residual exists for technical cracking of strong hashes or non-user credentials.
T1110.003prevents — awareness and training on password security, personal accountability, compliance with rules, and incident lessons can reduce the likelihood that weak/default passwords or poor configs enable spraying, but does not stop the technique itself when run against services with any remaining valid credentials
T1110.004prevents — awareness training on password hygiene, personal accountability, and compliance with rules can reduce password reuse that credential stuffing exploits, but does not stop adversaries from obtaining breach dumps or attempting the technique against accounts that still reuse credentials
T1111prevents — awareness/education/training on MFA responsibilities, procedures, and incident lessons can reduce successful interception by improving user behaviors and reporting, but does not stop the technique itself (e.g. keyloggers, SMS compromise) from running
T1114prevents — awareness/education/training on responsibilities, incident reporting, baseline controls and recognizing phishing lowers the chance users will allow or enable email collection (e.g. via credential compromise or malicious attachments), but does not stop server-side collection, forwarding rules or client-side exfiltration once access is obtained
T1114.002prevents — awareness/training on responsibilities, policy compliance, event reporting, and credential hygiene (e.g. password security) can stop some credential-based or insider-enabled remote email collection but leaves technical vectors, external token abuse, and misconfigurations untouched
T1114.003prevents — awareness, education and training on responsibilities, policy compliance, incident lessons, and basic procedures (including event reporting) can stop users/admins from creating or allowing malicious forwarding rules, but does not reach technical enforcement, hidden MAPI rules, transport rules, or credentialed adversary actions
T1127.001prevents — awareness/education/training on responsibilities, baseline controls (e.g. 5.17 password security), and lessons from incidents can reduce the likelihood that personnel enable or overlook MSBuild abuse, but does not stop a determined adversary from using a signed binary to proxy execution
T1127.002prevents — awareness/education/training on responsibilities, baseline controls (e.g. password security), incident lessons, and recognizing suspicious execution/install prompts can stop users from falling for the social-engineering or user-execution vectors that enable T1127.002, but cannot block the underlying trusted-utility abuse, rundll32 proxying, or startup-folder persistence once the technique is launched
T1133prevents — awareness/education/training on responsibilities, baseline controls (e.g. password security), incident lessons, and secure configuration skills can stop some misuse or misconfiguration of external remote services (especially credential-related or exposed unauthenticated cases) but leaves the bulk of the technique (e.g. legitimate VPN use with stolen valid accounts, Tor hidden services, or exposed container APIs) untouched.
T1136prevents — awareness, education and training on responsibilities, policies, procedures and incident lessons can reduce the chance an insider or privileged user creates a backdoor account, but does not stop a sufficiently-privileged adversary who already has access
T1136.003prevents — awareness, education and training on responsibilities, policies, incident lessons, and baseline controls (including account management and event reporting) can stop personnel from creating or allowing unauthorized cloud accounts, but does not stop a determined adversary who already has initial access or privileges
T1137prevents — awareness/education/training on responsibilities, policies, incident lessons, and baseline controls (e.g. macro handling) can stop users from enabling the Office persistence mechanisms, but does not guarantee removal of all technical vectors or cover every role
T1137.001detects — awareness/education/training surfaces knowledge of the technique (e.g. via incident lessons or macro policy) for some personnel but does not instrument or surface the persistence artifact itself
T1137.001prevents — awareness, education and training (including on macro security, policy compliance, and incident lessons) can stop users/admins from enabling or introducing malicious Office templates, but does not block the technique when macros are already permitted or the modification is performed by an already-compromised process
T1137.002prevents — awareness/education/training on responsibilities, policy compliance, incident lessons, and basic procedures (including event reporting) can prevent users/admins from deliberately or accidentally adding the malicious Office Test registry key, but does not stop all technical vectors or skilled adversaries
T1137.003detects — awareness/education/training surfaces knowledge of the technique (e.g. via incident lessons or recognizing suspicious forms/behavior) for some personnel but does not systematically detect the persistence mechanism itself
T1137.003prevents — awareness/education/training on responsibilities, policies, incident lessons, and baseline controls (e.g. event reporting) can prevent users from introducing or retaining malicious Outlook forms, but does not stop a technical exploit once the form is present or block all vectors
T1137.004detects — awareness training surfaces anomalous behavior and builds recognition of suspicious security events (including persistence techniques) but only when the implementer explicitly scopes it to cover this class of Office-based persistence
T1137.004prevents — awareness/education on responsibilities, policy compliance, incident lessons, and basic procedures (incl. event reporting) can prevent users from introducing or retaining malicious Outlook Home Page customizations, but does not stop a technical adversary who already has the needed mailbox access or code-execution foothold
T1137.005detects — awareness training can surface anomalous rules or suspicious emails as part of incident lessons and reporting procedures, but the control's focus is on personnel knowledge and responsibilities rather than systematic detection of the technique
T1137.005prevents — awareness/education/training on responsibilities, policies, incident lessons, and baseline controls (incl. event reporting) can stop users from creating or retaining malicious Outlook rules, but does not reach the technical execution path once rules are present
T1137.006detects — awareness/education/training on recognizing suspicious add-ins, reporting events (6.8), and keeping technical skills current can surface some misuse after the fact, but the control does not mandate or perform detection mechanisms
T1137.006prevents — awareness/education/training on responsibilities, policies, incident lessons, and baseline controls (incl. password security) can reduce the likelihood that users or admins introduce or tolerate malicious add-ins for persistence, but does not stop a skilled adversary from abusing them post-compromise or via technical means
T1140prevents — awareness/education/training on responsibilities, incident lessons, basic procedures (e.g. event reporting) and baseline controls can reduce the chance users or admins introduce, tolerate or manually trigger deobfuscation steps, but does not stop malware or system utilities from performing T1140 autonomously
T1176prevents — awareness/education/training on responsibilities, baseline controls (e.g. password security), incident lessons, and technical skills for secure configuration can stop users from installing malicious extensions or abusing benign ones via social engineering or poor practices, but leaves intact marketplace compromises, supply-chain attacks, and technical bypasses that do not rely on unaware or unskilled personnel
T1176.001prevents — awareness/education/training on responsibilities, policies, procedures, incident lessons, and baseline controls (e.g. password security) can stop users from installing malicious extensions via social engineering or app-store masquerading, but cannot stop file-based/silent installation after system compromise or manipulation of browser preference files
T1176.002prevents — awareness/education/training on responsibilities, baseline controls (e.g. password security), and lessons from incidents can reduce the chance developers or users install or trust malicious IDE extensions, but does not stop the technique itself (installation side-loading, marketplace compromise, or benign-extension abuse)
T1185prevents — awareness/education/training on responsibilities, incident lessons, basic procedures (e.g. event reporting) and baseline controls can lower the chance that personnel introduce or fall victim to browser hijacking vectors, but does not stop the underlying code-injection or permission-abuse techniques
T1187prevents — awareness/education/training on responsibilities, policies, incident lessons, and basic procedures (e.g. event reporting, password security) can reduce user susceptibility to opening spearphishing attachments or untrusted resources that trigger forced auth, but does not stop the underlying protocol behavior, crafted files, or EFSRPC abuse by adversaries
T1189prevents — awareness training on responsibilities, basic procedures (e.g. event reporting), recognizing suspicious sites, and not ignoring warnings can stop users from enabling scripting/notifications or visiting watering-hole sites, but cannot block all delivery vectors such as compromised legitimate sites or malvertising that require no user action beyond normal browsing
T1190prevents — awareness/education/training on responsibilities, baseline controls (e.g. password security), and lessons from incidents can prevent some classes of public-facing misconfigurations or weak setups that adversaries exploit, but leaves the dominant technical bug and unpatched-vulnerability slices of T1190 untouched
T1195prevents — awareness/education/training on responsibilities, baseline controls, incident lessons, and secure development practices lowers the chance personnel will introduce or overlook supply-chain weaknesses (e.g. insecure dependencies, unverified updates), but cannot stop external supplier or upstream compromise stages
T1195.001prevents — awareness/education/training on responsibilities, baseline controls (e.g. 5.17 password security), and lessons from incidents can prevent some developer behaviors that enable supply-chain compromise (e.g. failing to vet dependencies or falling for typosquatting), but does not stop upstream package or CI/CD component manipulation itself
T1199prevents — awareness/education/training on responsibilities, policies, incident lessons, and secure practices for external parties and technical teams can stop some trusted-relationship abuses (e.g. via better vetting, limited access configs, or recognizing suspicious third-party behavior), but leaves the dominant technical vectors (compromised accounts, delegated admin, network co-location) untouched
T1201prevents — awareness/training on password security and policy compliance (including lessons from incidents) reduces the chance that weak policies are set or left discoverable, but does not stop an adversary who already has the needed privileges from running the discovery commands or API calls
T1203prevents — awareness/education/training on responsibilities, policies, basic procedures (e.g. event reporting, password security) and secure configuration lowers the chance users will open malicious attachments or visit exploit sites that trigger T1203, but does not stop unpatched client software vulnerabilities or drive-by browser exploits that require no user action
T1204prevents — Trained users are more likely to recognize and avoid executing malicious files, links, or images delivered through social engineering, thereby limiting user-driven execution of adversary payloads.
T1204detects — awareness/training surfaces user knowledge gaps and incident patterns that can flag social-engineering vectors leading to execution, but does not instrument or observe the technique in flight
T1204.001detects — awareness training can surface anomalous user behavior (e.g. via reported incidents or observed click patterns) but does not instrument or monitor for the technique itself
T1204.001prevents — awareness training on responsibilities, policies, incident reporting, and social engineering reduces the chance users will click malicious links, but does not stop the technique from being available or succeeding in all cases
T1204.002prevents — awareness training on responsibilities, social engineering recognition, basic procedures and not opening suspicious attachments lowers the odds users will execute the malicious file, but does not stop the technique when social engineering or masquerading succeeds
T1204.003prevents — awareness/education/training on responsibilities, baseline controls (e.g. password security), incident lessons, and technical skills for configuring/maintaining secure images reduces the chance users will deploy backdoored ones, but does not stop the technique from succeeding when users still do so
T1204.004prevents — awareness training on social engineering, recognizing phishing/ClickFix lures, and not blindly copying/pasting commands directly lowers the chance users will fall for the technique, but does not stop determined adversaries or all users from executing it
T1204.005prevents — awareness/education on responsibilities, baseline controls (e.g. password security), and lessons from incidents can reduce the chance users install malicious libraries via typosquatting or unvetted package managers, but does not stop supply-chain compromise of popular libraries or guarantee users will recognize every malicious package
T1205.002prevents — awareness, education and training on responsibilities, procedures (including event reporting), baseline controls, and lessons from incidents can stop personnel from introducing or allowing socket filter backdoors, but does not reach the technical installation or elevated-privilege use of libpcap/setsockopt itself
T1210prevents — awareness/education/training on responsibilities, procedures, and secure configuration/maintenance lowers the chance that vulnerable remote services (unpatched, misconfigured) are present and exploitable, but does not guarantee they are absent
T1212prevents — awareness/education/training on responsibilities, baseline controls (e.g. password security), incident lessons, and secure configuration skills lowers the chance developers/admins introduce or leave exploitable credential-handling flaws, but does not stop the class of vulnerability from being written or exploited
T1213prevents — awareness/education/training on policy, responsibilities, baseline controls and incident lessons can reduce the human/configuration errors that leave repositories overly exposed, but does not stop deliberate abuse of legitimate access, external sharing features, or technical repository flaws
T1213.001prevents — awareness/education/training on responsibilities, policies, incident lessons, and baseline controls (e.g. password security, event reporting) lowers the chance personnel will store sensitive items like credentials, diagrams, or policies in an exposed Confluence repository, but does not stop the technique when misconfigurations, product defaults, or non-personnel vectors are the root cause
T1213.002prevents — awareness/education/training on policy compliance, incident lessons, basic procedures and personal accountability lowers the chance that personnel will store or leave the listed sensitive items (diagrams, credentials, source code, etc.) in SharePoint, thereby preventing the technique from having anything valuable to mine
T1213.003prevents — awareness/education/training on responsibilities, baseline controls (e.g. password security), incident lessons, and secure configuration skills lowers the chance that credentials or sensitive data are left unsecured in repos and that access is granted in the first place, but does not stop an already-privileged adversary from collecting what is present
T1213.005prevents — awareness/training on responsibilities, incident reporting, and basic procedures lowers the chance personnel will post credentials, source code, proprietary data or IR discussions into messaging apps, but does not stop the technique (e.g. misconfigured app permissions, external leaks, or non-personnel vectors remain unaddressed)
T1218.001prevents — awareness/education/training on responsibilities, baseline controls (e.g. password security), incident lessons, and recognizing suspicious content lowers the chance users will open or execute malicious .chm files delivered via T1204, but does not stop the technique from running on systems where it is already present or when users ignore training
T1218.002prevents — awareness/education on responsibilities, phishing recognition, incident lessons, and baseline controls (e.g. password security, event reporting) can stop users from executing or falling for malicious CPL items delivered via phishing or multi-stage malware, but cannot stop all abuse vectors such as direct command-line/programmatic execution or registry-based DLL loading by already-compromised code
T1218.005prevents — awareness/training on responsibilities, baseline controls (e.g. password security), and lessons from incidents can reduce the likelihood that personnel introduce or fall for mshta.exe abuse vectors, but does not stop the technique itself from running on a compromised or misconfigured Windows endpoint
T1219prevents — awareness/training on responsibilities, baseline controls (e.g. password security), incident lessons, and technical skills for maintaining security levels can reduce the likelihood of users/admins installing or enabling remote access tools (or failing to restrict them), but does not stop post-compromise abuse of legitimate/E DR tools or built-in modules
T1219.001prevents — awareness, education and training on responsibilities, baseline controls (e.g. password security), incident lessons, and secure configuration skills for technical teams can stop some developer misuse of IDE tunneling but leaves the dominant technical abuse vector (extensions, auto-reconnect, proprietary protocols on compromised machines) untouched
T1219.002prevents — awareness/education/training on responsibilities, baseline controls (e.g. password security), and lessons from incidents can reduce the likelihood that personnel will install or allow unauthorized remote desktop tools, but does not stop an adversary from bringing their own or exploiting already-permitted RMM software
T1221prevents — awareness/training on responsibilities, policy compliance, incident lessons, basic procedures (e.g. event reporting) and recognizing phishing/shared-content delivery vectors can stop users from opening or propagating template-injected documents, but does not block the adversary's core act of creating/modifying template references or RTF control words
T1222.001prevents — awareness, education and training on responsibilities, baseline controls (e.g. password security), policy compliance and incident lessons can reduce the likelihood an insider or authorized user performs or enables T1222.001, but the control does not stop an adversary who already has code execution from running icacls/takeown/etc.
T1484.001prevents — awareness, education and training on responsibilities, policy compliance, incident lessons, and baseline controls (including access-related topics) can prevent the human actions that enable GPO modification (e.g. unsafe delegation or credential compromise), but does not stop technical exploitation paths or guarantee correct behavior in all cases
T1485prevents — awareness, education and training on responsibilities, incident lessons, basic procedures and technical skills can stop some insider or configuration-driven data destruction but does not block the dominant external/adversary malware, credentialed propagation or cloud deletion paths
T1486recovers — A.6.3's awareness/education on responsibilities, incident lessons, event reporting (6.8) and backup implicitly enables post-ransomware recovery of encrypted data; extent is mostly because the control itself only trains people and does not directly perform or guarantee the recovery action (see A.8.13 anchor).
T1491.001prevents — awareness training on responsibilities, incident reporting, and basic procedures can reduce the likelihood or success of post-compromise internal defacement by improving user vigilance and faster response, but does not stop the adversary technique itself once access is obtained
T1496prevents — awareness/education/training on responsibilities, baseline controls (e.g. password security), incident lessons, and secure configuration skills for technical teams can stop some hijacking vectors (e.g. weak credentials or misconfigurations enabling cryptojacking) but leaves many others (e.g. supply-chain compromise, unpatched vulnerabilities, or insider abuse) untouched
T1496.001prevents — awareness/education/training on responsibilities, baseline controls (e.g. password security), incident lessons, and secure configuration skills can stop personnel from introducing the exposed APIs, weak credentials, or misconfigurations that enable initial access for compute hijacking, but leaves the dominant post-compromise execution vector and many technical vectors untouched
T1496.002prevents — awareness/training on responsibilities, incident lessons, basic procedures (e.g. event reporting) and baseline controls can stop users from enabling or ignoring the initial compromise that leads to bandwidth hijacking, but does not reach the dominant technical vectors (malware, botnets, proxyjacking, scanning) once systems are co-opted
T1496.004prevents — awareness/education/training on responsibilities, baseline controls (e.g. password security), incident lessons, and technical skills for maintaining security level can stop some hijacking vectors (e.g. credential compromise or misconfiguration enabling the service) but leaves intact others (e.g. post-compromise abuse of already-authorized SaaS quotas or LLM reverse-proxy techniques)
T1499prevents — awareness/education/training on responsibilities, incident lessons, basic procedures and technical skills can stop some insider or misconfigured endpoint DoS vectors (e.g. resource exhaustion from poor config or unpatched services) but leaves the dominant external/botnet/spoofing techniques untouched
T1505.003prevents — awareness/education/training on responsibilities, incident lessons, basic procedures (e.g. event reporting) and secure configuration lowers the chance personnel will introduce or overlook a web shell, but does not stop a determined adversary from placing one via unpatched vulnerabilities, supply-chain compromise, or other technical vectors
T1518.001prevents — awareness, education and training on responsibilities, baseline controls (e.g. password security), incident reporting, and keeping technical skills current can reduce the likelihood an insider or user-assisted adversary performs or succeeds at security software discovery, but does not stop the technique itself from running on compromised systems
T1528prevents — awareness/training on responsibilities, phishing recognition, secure practices and incident lessons can stop users from falling for OAuth/social-engineering token-theft paths and from misconfiguring service accounts, but cannot stop post-compromise token extraction from already-breached containers, VMs or CI/CD pipelines
T1530prevents — awareness/education/training on responsibilities, policy compliance, baseline controls (e.g. password security), and lessons from incidents can stop some misconfigurations and credential leaks that enable T1530, but does not reach the dominant technical causes (IAM policy errors, public bucket settings) or guarantee correct application by all parties
T1531prevents — awareness, education and training on responsibilities, incident reporting, password security and management commitment can stop some insider or social-engineering-enabled account manipulations but does not stop the dominant technical execution paths (e.g. compromised admin accounts using net, PowerShell, passwd, esxcli or Group Policy)
T1534prevents — awareness/education/training on responsibilities, policies, procedures, incident lessons, and recognizing phishing lowers the chance users fall for internal spearphishing lures or impersonation, but does not stop the initial account compromise stage or guarantee error-free behavior
T1538prevents — awareness training on responsibilities, incident lessons, basic procedures (e.g. event reporting) and policy compliance can reduce the likelihood of credential compromise or subsequent dashboard misuse, but does not stop the technique when credentials are already stolen
T1539prevents — awareness/training on responsibilities, basic procedures (e.g. event reporting, password security), phishing recognition, and not falling for social engineering lowers the odds of user actions that enable cookie theft (e.g. running malicious JS, falling for phishing/AitM proxies), but does not stop malware, JS injection, or technical acquisition methods
T1543.002prevents — awareness, education and training on responsibilities, procedures, incident lessons, and secure configuration skills for technical teams can stop some personnel from creating or modifying malicious systemd services, but does not block the technique itself (e.g. via compromised accounts, automation, or insiders who ignore training)
T1543.003prevents — awareness, education and training on responsibilities, baseline controls (e.g. password security), incident reporting, and technical skills for secure configuration can stop some insiders or less-sophisticated actors from creating/modifying malicious services, but leaves the dominant technical attack surface (Registry edits, API abuse, driver loading, privilege escalation, hiding) untouched
T1543.005prevents — awareness, education and training on responsibilities, baseline controls (e.g. password security), incident lessons, and technical skills for configuring/maintaining secure container services can stop some misuse that leads to this technique but does not prevent the code/config defects or privileged access that enable it
T1546prevents — awareness/education/training on responsibilities, incident lessons, basic procedures (e.g. event reporting) and baseline controls lowers the chance that personnel will create or tolerate the malicious event triggers that enable T1546, but does not stop a determined adversary who already has initial access from abusing or installing them
T1546.001prevents — awareness, education and training on responsibilities, baseline controls (e.g. password security), policy compliance, and incident lessons can lower the chance an insider or user-assisted change to file associations occurs, but does not stop the technique itself (especially when performed by malware with registry access)
T1546.003prevents — awareness/education/training on responsibilities, incident reporting, and baseline controls can lower the chance an insider or admin introduces or tolerates a malicious WMI subscription, but does not stop the technique itself
T1546.004prevents — awareness/education/training on responsibilities, policy compliance, basic procedures (incl. event reporting) and secure configuration lowers the chance users/admins will insert or tolerate malicious shell config changes, but does not stop the technique outright (especially root-level or skilled-adversary modifications)
T1546.012prevents — awareness, education and training on responsibilities, baseline controls (e.g. password security), incident lessons, and secure configuration skills can stop some IFEO registry abuse by informed admins and developers, but leaves the dominant technical persistence/privilege-escalation vector in place
T1546.013prevents — awareness/training on responsibilities, baseline controls (e.g. password security), and incident lessons can reduce the chance users/admins introduce or overlook malicious profile modifications, but does not stop the technique itself
T1546.015prevents — awareness/education/training on responsibilities, baseline controls (e.g. password security), incident lessons, and secure configuration skills can reduce the likelihood that personnel introduce or overlook COM hijacking Registry changes, but does not stop a determined adversary from performing the technique
T1546.016prevents — awareness/education/training on responsibilities, baseline controls (e.g. password security), and incident lessons can reduce the likelihood that users or admins install tampered packages or grant elevated permissions to malicious installers, but does not stop modified legitimate installers or root-running maintainer scripts from executing
T1547.001prevents — awareness/education/training on responsibilities, baseline controls (e.g. password security), and lessons from incidents can lower the chance an insider or admin adds a malicious run-key or startup item, but does not stop the configuration technique itself
T1547.003prevents — awareness/education/training on responsibilities, baseline controls (e.g. password security), and incident lessons can reduce the chance an insider with admin rights registers a malicious time-provider DLL, but does not stop the technique itself
T1547.004prevents — awareness/education/training on responsibilities, baseline controls (e.g. password security), incident lessons, and secure configuration skills can lower the chance an insider or admin introduces or tolerates the malicious Registry modification, but does not stop a determined adversary who already has the needed privileges
T1547.006prevents — awareness, education and training can lower the chance that personnel (admins, developers) will introduce, approve or fail to detect malicious kernel modules, but does not stop a determined adversary from loading one
T1547.007prevents — awareness, education and training on responsibilities, baseline controls (e.g. password security), incident lessons, and secure configuration skills for technical teams can stop users/admins from enabling or adding malicious persistence via the reopen plist, but leaves many other persistence vectors and non-aware actors untouched
T1547.012prevents — awareness, education and training on responsibilities, baseline controls (e.g. password security, event reporting), and lessons from incidents can reduce the likelihood an insider or privileged user performs the SeLoadDriverPrivilege-enabled installation steps, but does not stop the technique itself
T1547.015prevents — awareness/education/training on responsibilities, baseline controls (e.g. password security), incident lessons, and secure configuration skills can stop users/admins from adding malicious login items, but does not address the underlying macOS mechanisms or block all adversary use of AppleScript/Native API
T1548.002prevents — awareness/education/training on responsibilities, policy compliance, incident lessons, and secure procedures (e.g. password security, event reporting) can prevent some user-driven or misconfiguration-enabled UAC bypasses but leaves technical bypass methods (DLL injection, auto-elevated COM, eventvwr.exe, etc.) untouched
T1548.003prevents — awareness/education/training on responsibilities, baseline controls (e.g. password security), policy compliance, and lessons from incidents can stop users/admins from creating the poor sudo/sudoers configurations that the technique abuses, but does not guarantee correct configurations or block all abuse vectors
T1548.004prevents — awareness/education/training on responsibilities, policy compliance, basic procedures (e.g. event reporting, password security), and lessons from incidents can reduce the likelihood that users fall for the social-engineering or masquerading aspects of this technique, but cannot stop the deprecated API from functioning or prevent malicious code that abuses it without user interaction
T1548.005prevents — awareness, education and training on responsibilities, policies, baseline controls and lessons from incidents can reduce the likelihood of the misconfigurations that enable this technique, but does not guarantee correct permission configurations or remove the underlying mechanisms
T1548.006prevents — awareness, education and training on responsibilities, baseline controls (e.g. password security), and incident lessons can reduce the likelihood of users or admins granting excessive TCC permissions or disabling SIP, but does not stop the technique when SIP is already off, when abusing already-granted permissions via injection, or when the adversary has write access to the TCC database
T1550prevents — awareness/training on responsibilities, incident lessons, password security, and secure configuration lowers the chance of alternate auth material (e.g. tickets/hashes) being mishandled or exposed, but does not stop the technique itself
T1550.001prevents — awareness/training on responsibilities, policies, incident lessons, password security, and event reporting lowers the chance users will fall for the social-engineering or misconfiguration vectors that commonly lead to token theft or misuse, but cannot stop all technical compromise paths (e.g., direct credential theft, misconfigured IAM permissions, or refresh-token persistence) described in the technique
T1550.004prevents — awareness/training on responsibilities, MFA bypass risks, incident lessons, and secure practices (e.g. cookie hygiene) can stop users from enabling cookie theft or reuse, but does not block the technique itself once a cookie is obtained
T1552.001prevents — awareness/education/training on responsibilities, password security, and incident lessons can stop users from creating/storing insecure credential files and can stop admins from configuring systems to do so, but cannot reach all adversary paths (e.g. third-party software defaults, container logs, or already-embedded credentials)
T1552.003prevents — awareness/training on responsibilities, password security, and incident lessons can reduce the chance users type credentials in command lines that end up in shell history, but does not stop the technique itself or eliminate the history files
T1552.004prevents — awareness, education and training on responsibilities, baseline controls (e.g. password security), and lessons from incidents can reduce the likelihood that personnel create or leave private keys insecurely stored, but does not stop the technique once a system is already compromised nor reach all vectors (e.g. device keys, network device export)
T1552.006prevents — awareness/education/training on responsibilities, policy compliance, incident lessons, and baseline controls (e.g. password security) can prevent administrators from embedding plaintext credentials in GPP in the first place, but does not stop the technique when it is performed by already-compromised accounts or external discovery of legacy GPP files
T1552.007prevents — awareness/education/training on responsibilities, baseline controls (e.g. password security), incident lessons, and technical skills for configuring/maintaining secure container environments lowers the chance of the misconfigurations that expose Docker/Kubernetes APIs, but does not guarantee their prevention
T1552.008prevents — awareness/training on responsibilities, policy compliance, basic procedures (e.g. event reporting, password security) and not sharing credentials can stop users from posting them in chat, preventing the technique at its human-error root, but this is only a slice of the class (technical collection paths, compromised integrations, admin portals remain unaddressed)
T1553prevents — awareness/education/training on responsibilities, policies, procedures and baseline controls (e.g. password security, event reporting) can reduce the likelihood that users or admins will perform the configuration changes or certificate misuse that enable T1553, but does not stop an adversary who already has the needed privileges or skills
T1553.004prevents — awareness, education and training on responsibilities, baseline controls (e.g. password security), incident lessons, and technical skills for maintaining security configuration can reduce the chance personnel introduce, overlook or fail to remediate a malicious root certificate, but does not stop an already-compromised system or supply-chain insertion
T1553.006prevents — awareness/education/training on responsibilities, baseline controls (e.g. password security), and lessons from incidents can lower the chance that authorized insiders (admins/developers) will intentionally or accidentally modify code-signing policies, but does not stop an adversary who already has elevated access from doing so via registry, kernel memory, or recovery-mode changes
T1555prevents — awareness, education and training on password security, responsibilities, and incident lessons can stop some users/admins from creating weak stores or exposing credentials, but cannot stop the adversary technique itself once a vulnerable store exists on the system
T1555.003prevents — awareness, education and training on responsibilities, password security, incident lessons, and secure configuration can stop users/admins from storing reusable browser credentials or from leaving extractable plaintext, but cannot stop all adversary extraction methods (e.g. memory scraping, unpatched browser flaws, or already-stored credentials on compromised hosts)
T1555.005prevents — awareness, education and training on password security, responsibilities, and incident lessons can reduce the likelihood users choose weak master passwords or engage in behaviors that enable memory scraping or brute-force, but cannot stop all extraction techniques or technical flaws in the password manager itself
T1556.005prevents — awareness, education and training on responsibilities, policy compliance, password security and incident lessons can stop personnel (including admins) from enabling reversible encryption, but does not block an already-privileged adversary who sets the property directly via PowerShell, FGPP or GPO
T1556.007prevents — awareness, education and training on responsibilities, baseline controls (e.g. password security), incident lessons, and technical skills for maintaining authentication components can lower the chance of the initial compromise or misconfiguration that enables this backdooring technique, but does not stop a determined adversary who already has sufficient privileges
T1556.008prevents — awareness/education/training on responsibilities, baseline controls (e.g. password security), and lessons from incidents can reduce the chance an insider or admin registers a malicious network provider DLL, but does not stop the technique itself from being available or executed by a determined adversary
T1556.009prevents — awareness/education/training on responsibilities, policy compliance, MFA/password basics, and incident lessons can reduce the chance an insider or compromised account holder modifies conditional access policies, but does not stop a technical adversary who already has sufficient privileges from doing so
T1557.001prevents — awareness/education/training on responsibilities, policies, incident lessons, and baseline controls (e.g. password security) can stop personnel from falling for or enabling the poisoning/relay (e.g. by disabling LLMNR/NBT-NS/mDNS or not using weak NTLM), but does not stop the network-level technique itself when run by an already-present adversary
T1557.004prevents — awareness/education on responsibilities, recognizing phishing-like Wi-Fi tricks, reporting events, and safe connection practices can stop users from connecting to evil twins, but does not block the adversary technique itself (e.g. rogue AP deployment) and leaves technical vectors like device auto-connect or PNL responses untouched
T1558prevents — awareness/education/training on responsibilities, incident lessons, password security, and technical skills for maintaining authentication systems can reduce the likelihood of misconfigurations or user actions that enable Kerberos ticket theft/forgery, but does not stop a determined adversary from exploiting the technique
T1558.003prevents — awareness/education/training on responsibilities, baseline controls (e.g. password security), incident lessons, and technical skills for maintaining security level can reduce likelihood of weak service accounts or RC4 usage that enable Kerberoasting, but does not stop the technique itself
T1558.004prevents — awareness, education and training on responsibilities, policies, password security, and incident lessons can reduce the chance that accounts are left with pre-authentication disabled or that weak RC4 usage is tolerated, but does not stop the technique itself when such accounts exist
T1558.005prevents — awareness, education and training on responsibilities, baseline controls (e.g. password security), incident lessons, and secure configuration of systems/devices can reduce the likelihood of ccache files being left exposed on disk or in memory, but cannot stop an adversary who already has session access or can reach the files via other means
T1559.002prevents — awareness, education and training on responsibilities, baseline controls (e.g. 5.17 password security), incident lessons, and technical skills can reduce the likelihood of users enabling DDE, opening poisoned Office/CSV documents, or falling for delivery vectors, but does not stop the technique itself when it is used by a compromised account or invoked via DCOM/Remote Services
T1563prevents — awareness, education and training on responsibilities, baseline controls (e.g. password security), incident lessons, and secure configuration/maintenance for technical teams lowers the chance that sessions are left exposed or hijackable, but does not stop an adversary who already has valid access from commandeering an established session
T1563.001prevents — awareness, education and training on responsibilities, baseline controls (e.g. password/SSH key security), incident lessons, and technical skills for configuring/maintaining secure SSH can stop users/admins from creating the weak agent-socket or key-trust conditions the technique exploits, but cannot reach all root-compromise paths or every implementation gap
T1564.002prevents — awareness/education/training on responsibilities, policies, procedures and incident lessons can reduce the chance that legitimate admins or users will create hidden accounts (or leave the configuration that enables the technique), but does not stop a malicious adversary who already has the needed privileges from performing the technique
T1564.003prevents — awareness training on responsibilities, incident lessons, basic procedures (e.g. event reporting) and baseline controls can reduce the likelihood that personnel (including admins) will introduce or tolerate hidden-window techniques, but does not stop adversaries from abusing the underlying OS/scripting/Registry/APIs
T1565prevents — awareness/education/training on responsibilities, procedures, and technical skills (incl. secure configuration and incident lessons) lowers the chance that personnel enable or fail to stop data manipulation, but does not stop a skilled adversary who already has the needed access or expertise
T1566prevents — Personnel who regularly receive awareness training on phishing indicators and reporting procedures are less likely to open malicious attachments or click malicious links, reducing the success rate of phishing campaigns.
T1566detects — awareness training on recognizing phishing (via incidents, reporting procedures, and basic security practices) enables personnel to detect and report suspicious messages, but the control itself is not a detection mechanism and leaves technical detection (e.g., email filtering) untouched
T1566.001detects — awareness training on recognizing phishing, reporting events, and baseline controls surfaces the technique when users notice and report it, but the control does not instrument or guarantee detection of delivery or execution
T1566.001prevents — awareness/education/training on responsibilities, policies, basic procedures (e.g. event reporting, password security), and recognizing social engineering lowers the odds users open malicious attachments or fall for the lures, but does not stop the technique from being attempted or executed by those who ignore it
T1566.002detects — awareness training on recognizing phishing, reporting events, and understanding social engineering can surface some spearphishing-link attempts (especially when users notice and report them), but the control does not instrument, monitor, or systematically detect the technique itself
T1566.002prevents — awareness/training on recognizing phishing, reporting events, and baseline procedures (e.g. password security) lowers the chance users will click malicious links or fall for social engineering, but does not stop the technique from being attempted or succeeding against untrained, non-compliant, or technically exploited users
T1566.003detects — awareness training on recognizing spearphishing (including via social media/webmail) and reporting suspicious contacts surfaces the technique when the recipient notices it, but the control only equips human detection and does not instrument or guarantee discovery of the messages themselves
T1566.003prevents — awareness/education/training on recognizing social engineering, reporting suspicious contacts, and handling unexpected messages via personal/third-party channels directly lowers the chance the technique is successful against trained personnel
T1566.004detects — awareness training on recognizing social engineering (including vishing indicators, reporting events, and MFA tricks) surfaces the technique when users notice and report it, but the control only equips human detection and does not instrument or guarantee discovery of calls, prompts, or downstream execution
T1566.004prevents — awareness/education/training on recognizing social engineering (including vishing indicators, urgency, impersonation, and reporting) directly lowers the chance users fall for T1566.004, but cannot stop determined adversaries or all variants as it relies on human behavior change rather than technical blocking
T1567prevents — awareness/education/training on responsibilities, baseline controls (e.g. password security, event reporting), and policy compliance can reduce the likelihood that an insider or compromised account enables or performs web-service exfiltration, but does not stop the technique itself when executed by an adversary who already has the necessary access or foothold
T1567.003prevents — awareness, education and training on responsibilities, incident lessons, baseline controls (e.g. password security, event reporting) and secure configuration can stop some insider or developer misuse of text storage sites for exfiltration, but leaves the dominant external-adversary technique (post-compromise outbound transfer) untouched
T1567.004prevents — awareness/training on responsibilities, incident reporting, and baseline controls (e.g. password security) can prevent some webhook exfiltration vectors that rely on user actions or misconfigurations, but leaves the bulk of the technique (SaaS linking, direct HTTPS posts, blending with normal traffic) untouched
T1574prevents — awareness/education/training on responsibilities, baseline controls (e.g. password security), and lessons from incidents can reduce the chance that personnel introduce or overlook the configurations that enable execution-flow hijacking, but does not stop an adversary from exploiting such weaknesses once present
T1574.001prevents — awareness/education/training on responsibilities, baseline controls (e.g. password security), and lessons from incidents can reduce the likelihood that personnel introduce or overlook the insecure configurations and practices that enable DLL sideloading/search-order hijacking, but does not stop an adversary from exploiting the technique once those conditions exist
T1574.005prevents — awareness/education/training on responsibilities, baseline controls (e.g. password security), and lessons from incidents can reduce the chance that developers or admins introduce or tolerate the insecure permissions that enable this technique, but does not itself enforce correct permissions or stop the weakness from being written into installers
T1574.006prevents — awareness, education and training on responsibilities, baseline controls (e.g. password security), and lessons from incidents can reduce the chance that personnel (esp. developers/admins) will leave exploitable environment variables or debugging configurations in place, but does not stop an adversary who can already set LD_PRELOAD/DYLD_INSERT_LIBRARIES on a compromised account or process
T1574.008prevents — awareness, education and training on responsibilities, baseline controls (e.g. password security), and lessons from incidents can reduce the likelihood that developers or admins introduce or tolerate vulnerable search-order behavior, but does not stop the technique from being available in deployed software
T1574.009prevents — awareness/education/training on responsibilities, baseline controls (e.g. password security) and lessons from incidents can lower the chance developers or admins introduce unquoted paths, but does not stop the code/config defect itself
T1574.011prevents — awareness/education/training on responsibilities, policy compliance, baseline controls (e.g. password security) and incident lessons can reduce the chance that misconfigurations in service Registry permissions are introduced or left in place, but does not itself enforce correct ACLs or prevent the technique
T1583.001prevents — awareness/education/training on policy, responsibilities, incident lessons, and baseline controls (e.g. event reporting) can prevent some insider-enabled or policy-violating domain acquisitions but does not stop external adversaries from purchasing, typosquatting, or registering domains in compromised environments
T1583.008prevents — awareness training on responsibilities, policies, incident lessons, and baseline controls (e.g. recognizing spoofed ads or reporting events) can stop users from falling for malvertising lures, but the technique itself is an adversary purchase and placement that training does not block at source
T1584.001prevents — awareness, education and training on responsibilities, incident lessons, password security, event reporting, and social engineering reduce the likelihood of the human-enabled vectors (email compromise, help-desk social engineering, renewal gaps) but do not stop technical subdomain hijacking, cloud-service compromise, or deprovisioned-resource gaps
T1586prevents — awareness, education and training on responsibilities, policies, password security, incident reporting and social-engineering vectors (e.g. phishing for credentials) lowers the chance that employees or partners will fall for or assist the compromise methods listed in T1586, but cannot stop all vectors (e.g. external credential purchases, brute-force of non-organizational accounts, or adversary reconnaissance)
T1586.001prevents — awareness/training on responsibilities, password security, incident reporting, and social-engineering basics lowers the chance personnel will fall for credential theft or reuse that enables account compromise, but does not stop reconnaissance, credential purchase, or adversary-controlled external accounts
T1586.002prevents — awareness, education and training on responsibilities, policies, incident reporting, password security, and recognizing phishing lowers the chance that employees, suppliers or partners will fall for credential-theft lures or willingly hand over access, directly blocking the human-targeted compromise vectors named in the technique; it leaves technical brute-force, purchased credentials, and reconnaissance-driven selection of high-reputation accounts untouched
T1586.003prevents — awareness, education and training on responsibilities, policies, password security, incident reporting and phishing lowers the chance that personnel will fall for credential-theft vectors (phishing, password spraying, token theft) that lead to cloud-account compromise, but cannot stop external purchase of credentials, reconnaissance-driven targeting of provider accounts, or technical exploits outside human factors
T1588.005prevents — awareness/education/training on responsibilities, policies, incident lessons, and secure practices can reduce the likelihood that an insider (or unwitting personnel) will introduce, share, or fail to report acquired exploits, but does not stop external adversaries from buying/stealing/downloading them independently
T1588.007prevents — awareness/education/training on responsibilities, policies, incident lessons, phishing/social-engineering recognition, and secure development lowers the chance that personnel introduce or fall for AI-assisted techniques (e.g. phishing content, obfuscated payloads, impersonation), but does not stop adversaries from obtaining and using public LLMs themselves
T1589prevents — awareness training on responsibilities, policies, incident reporting, password security, and social engineering lowers the chance personnel will leak identity data via elicitation or misconfiguration, but does not stop passive collection from public leaks, active scanning, or technical enumeration of MFA configs
T1589.001prevents — awareness training on responsibilities, policy compliance, password security, incident reporting, and recognizing elicitation/phishing directly lowers the chance users expose credentials via personal reuse, weak practices, or falling for gathering techniques, but cannot stop technical collection from breaches, dark web markets, or compromised sites
T1589.003prevents — awareness training on personal accountability, incident reporting, phishing recognition, and not exposing staff details lowers the chance employees publish or leak names online, preventing the easy public gathering step in the technique
T1590.003prevents — awareness training on responsibilities, policy compliance, incident reporting, and phishing elicitation reduces the chance personnel will inadvertently expose or confirm network trust details (e.g. via social engineering or misconfigured disclosures), but cannot stop passive/public data exposure or adversary research that does not involve trained personnel
T1591prevents — awareness training on responsibilities, incident reporting, phishing recognition, and social engineering lowers the chance personnel will disclose org details via elicitation or oversharing, but cannot stop passive public data exposure or non-human sources
T1591.002prevents — awareness training on responsibilities, incident lessons, phishing recognition, and rules for handling external parties (contractors/suppliers) reduces the chance personnel will inadvertently expose business-relationship details via elicitation or public data sets, but cannot stop passive OSINT or adversary actions outside the organization
T1591.003prevents — awareness training on responsibilities, policy compliance, incident reporting, and social engineering (e.g. phishing elicitation) reduces the chance personnel will leak business-tempo details via inadvertent disclosure or failure to protect public data, but cannot stop passive collection from already-public sources or non-human leaks
T1591.004prevents — awareness training on responsibilities, policy compliance, incident reporting, and social engineering recognition (built on lessons from incidents) reduces successful elicitation via phishing-for-information and lowers the chance personnel expose role data on social media or websites, but cannot stop passive public data exposure or all reconnaissance vectors
T1593prevents — awareness training on responsibilities, policy compliance, incident lessons, and basic procedures (e.g. event reporting) can prevent personnel from posting or leaking victim information on open websites/domains that adversaries search, but does not stop external public data or adversary searches themselves
T1593.001prevents — awareness training on social media risks, personal accountability, incident lessons, and not sharing roles/locations/interests lowers the chance staff will post targetable data that adversaries can harvest, but does not stop all such information (e.g. official business announcements) from appearing
T1593.002prevents — awareness training on responsibilities, incident lessons, basic procedures and not leaking sensitive data (e.g. credentials, network details) lowers the chance personnel will create the spillages that T1593.002 harvests, but does not stop public indexing of non-leaked information or adversary queries against it
T1593.003prevents — awareness training on responsibilities, secure coding, and not leaking credentials/secrets can stop some accidental exposures in public repos that enable the technique, but cannot stop all public code (e.g. intentional open-source projects) or adversary searches of them
T1598prevents — Security awareness reduces the chance that employees will disclose sensitive organizational information when targeted by information-gathering phishing attempts.
T1598.001prevents — awareness training on social engineering, phishing recognition, and reporting lowers the chance targets will engage with or divulge information to spearphishing lures, but does not stop the adversary from sending the messages or guarantee every recipient will recognize and ignore them
T1598.002prevents — awareness training on recognizing social engineering, reporting suspicious attachments/emails, and understanding responsibilities directly lowers the chance personnel will open/respond to the lure, but does not stop the adversary from sending it or guarantee every recipient will act correctly
T1598.003detects — awareness training on recognizing phishing lures, reporting events, and spotting suspicious links/QR codes surfaces some instances of the technique in flight or after receipt, but the control is silent on instrumentation, monitoring, or automated detection mechanisms and leaves the bulk of technical detection (e.g. email scanning, web beacons, BitB) untouched
T1598.003prevents — awareness/education/training on recognizing social engineering, phishing lures, suspicious links/QR codes, and reporting reduces the chance users will fall for T1598.003, but does not stop the technique from being attempted or guarantee every recipient will avoid it
T1598.004prevents — awareness/education/training on recognizing social engineering (including vishing indicators, reporting, and personal accountability) lowers the chance the technique succeeds against trained personnel, but does not stop adversaries from executing the call or guarantee universal resistance
T1599prevents — awareness, education and training on responsibilities, baseline controls (e.g. password security), incident lessons, and secure device configuration can stop some personnel from introducing the misconfigurations or credential issues that enable boundary-device compromise, but cannot prevent all paths (e.g. zero-days, supply-chain compromise of the device itself, or non-human error)
T1602.001prevents — awareness/education/training on responsibilities, baseline controls (e.g. password security), and lessons from incidents can reduce the likelihood of SNMP misconfigurations that enable MIB dumping, but does not stop the technique when SNMP is required and left exposed
T1608.004prevents — awareness training on responsibilities, incident lessons, basic procedures (e.g. event reporting) and baseline controls can reduce the chance some personnel enable drive-by staging (e.g. via insecure web content management or falling for watering-hole setup), but leaves the dominant adversary-side staging, infrastructure acquisition, and technical injection untouched
T1608.005prevents — awareness training on phishing, social engineering, suspicious links, reporting obligations, and recognizing cloned/malicious sites directly lowers the chance users will click or be deceived by T1608.005-prepared link targets, but cannot stop adversaries from setting up the infrastructure itself
T1621prevents — awareness/education/training on MFA responsibilities, fatigue risks, and reporting suspicious requests lowers the chance users will approve adversary-generated MFA prompts, but does not stop the technique from running or guarantee users will always refuse
T1649prevents — awareness/education/training on responsibilities, baseline controls (e.g. password security, event reporting), and lessons from incidents lowers the chance personnel will enable certificate theft (via poor key handling or misconfigs) or abuse enrollment rights, but does not stop technical forging, root-CA compromise, or the technique itself
T1657prevents — awareness/education/training on responsibilities, policies, incident reporting, social engineering recognition, and baseline controls (e.g. password security) lowers the probability that personnel fall for the social-engineering, BEC, impersonation, or ransomware-payment vectors that enable most financial theft, but cannot stop technical theft, account compromise, or post-breach extortion once the adversary is inside
T1667prevents — awareness training on responsibilities, incident reporting, phishing/social engineering, and recognizing suspicious sign-up patterns can stop some email bombing vectors (especially the precursor social-engineering follow-on), but does not block automated bot-driven newsletter signups or inbox flooding itself
T1671prevents — awareness/education/training on responsibilities, policies, procedures, and incident lessons can lower the chance users or admins will consent to, create, or fail to review malicious OAuth integrations, but does not stop a determined adversary who already has a high-privileged account or who bypasses consent entirely
T1677prevents — awareness/education/training on responsibilities, secure practices, and incident lessons can reduce the likelihood that insiders or developers introduce or overlook poisoned pipeline code (e.g. via unsafe PR handling or weak config), but does not stop external supply-chain or public-pipeline attacks that require no insider action
T1683prevents — awareness/education/training on responsibilities, policies, incident lessons, and social-engineering basics lowers the chance personnel will fall for or assist generated-content pretexts (e.g., phishing, impersonation), but does not stop adversaries from independently creating the content itself
T1683.001prevents — awareness/education/training on responsibilities, policies, incident lessons, and baseline procedures (e.g. event reporting, password security) can stop some personnel from falling for or propagating the written-content lures that target them, but does not stop adversaries from creating or tailoring the materials themselves
T1683.002prevents — awareness/education/training on responsibilities, policies, incident lessons, and baseline controls (e.g. recognizing phishing or social engineering) lowers the chance personnel fall for or propagate synthetic A/V content used in those downstream techniques, but does not stop adversaries from creating or manipulating the content itself
T1684detects — A.6.3's awareness/training on recognizing social engineering (e.g. via incidents, reporting procedures, and role-specific education) surfaces some instances of the technique when users notice and report it, but does not instrument or guarantee detection of the broad range of channels, narratives, or AI-enabled variants in the class.
T1684prevents — awareness/education/training on responsibilities, policy, procedures, incident lessons, and baseline controls (e.g. event reporting, password security) lowers the odds users fall for social-engineering lures, but does not stop the technique from being attempted or succeeding in all cases
T1684.001detects — awareness training on recognizing impersonation (via social engineering indicators, incident lessons, and reporting procedures) surfaces the technique when personnel notice and report it, but the control's scope is limited to human observers and does not instrument or detect the preceding reconnaissance, infrastructure, or non-reported instances
T1684.001prevents — awareness training on responsibilities, policies, incident reporting, and recognizing social engineering (including impersonation via phishing) lowers the chance victims fall for the technique, but does not stop adversaries from executing it or guarantee all personnel will recognize every instance
T1684.001responds — A.6.3's awareness/education programme (built on lessons from incidents, covering event reporting, and training on recognizing social engineering) equips personnel to recognize and report an impersonation campaign once underway, enabling organizational response, but does not itself perform containment or eradication.
T1684.002prevents — awareness/education/training on responsibilities, policies, incident lessons, and baseline controls (e.g. event reporting, password security) can reduce successful social engineering via spoofed emails but does not stop the technical technique of header modification or weak DMARC/SPF/DKIM configurations
T1685prevents — awareness, education and training on responsibilities, baseline controls, incident reporting and keeping technical skills current can reduce the likelihood that personnel (or insiders) will disable/modify tools, but does not stop determined adversaries from using the many technical methods described
T1685.001prevents — awareness/education/training on responsibilities, incident reporting, and baseline controls (including audit policy) can stop some users from running disable/modify techniques, but does not block admins or technically skilled insiders who already know the commands
T1685.002prevents — awareness/education/training on responsibilities, incident lessons, event reporting and baseline controls (e.g. 6.8, 5.17) can stop some insiders or permission-holders from choosing to disable/modify logging, but does not block technical abuse by determined adversaries who already possess sufficient privileges

Prevented OWASP Web Top 10 (2025) risks (2)

OWASP Web Top 10 (2025) risk categories this ISO control helps prevent or mitigate — our AI-authored analysis (authority llm_unverified, under review).

Direction: ← other covers this; → this covers other (F/M/P = full / mostly / partial). gov = governs / implements (a mandate, not coverage).

A02←P A09←M

Control IDs, short titles and the structured attribute table (control type, CIA properties, cybersecurity-concept, operational capability, security domain) are facts from ISO/IEC 27001:2022 Annex A / ISO/IEC 27002:2022. The full implementation guidance prose lives in ISO/IEC 27002:2022 — not reproduced here. Cross-walks to NIST 800-53, NIST CSF 2.0, OWASP ASVS, CWE, MITRE ATT&CK and OWASP Web Top 10 are our own AI-authored analysis (authority llm_unverified, under review), not an ISO, NIST, MITRE or OWASP product — how ours compare.