Most people in cyber know ATT&CK. But....... D3FEND is the part we skip and honestly, I think that’s a…
Om S. — CyberSecurity Research Engineer
Most people in cyber know ATT&CK.
But.......
D3FEND is the part we skip and honestly, I think that’s a mistake.
I spent a few nights going through it properly, and the interesting part is not the number of techniques. It’s the mindset shift.
ATT&CK tells you how attackers move.
D3FEND tells you how defenders should respond in a structured way.
What stood out to me:
->
-It’s a knowledge graph, not just a static list.
-It connects defensive techniques to the attacks they counter.
-It gives defenders a common language instead of vague “best practice” talk.
- It feels more useful when you are mapping detection, response, or OT/ICS hardening.
->
For VAPT, OT/ICS, and CVE research, that matters.
==============================
We spend so much time understanding the attack path that we sometimes forget to model the defense with the same discipline.
===================================
My take: ATT&CK gets more attention, but D3FEND deserves more real use.
?????????????????????????????????????????????????????????????????????
Question for the room — are you actually using D3FEND in your workflow, or is it still just another framework people mention in posts
?????????????????????????????????????????????????????????????????????
#CyberSecurity #MITREATTACK #D3FEND #InfoSec #BlueTeam #ThreatIntelligence #VAPT #OTSecurity
4 reactions · 0 comments
Topics: #blueteam, #vapt, #mitreattack, #infosec, #threatintelligence, #otsecurity, #cybersecurity, #d3fend