MITRE ATLAS

TA0000 — AI Model Access

TA0001 — AI Attack Staging

TA0002 — Reconnaissance

TA0003 — Resource Development

TA0004 — Initial Access

TA0005 — Execution

TA0006 — Persistence

TA0007 — Defense Evasion

TA0008 — Discovery

TA0009 — Collection

TA0010 — Exfiltration

TA0011 — Impact

TA0012 — Privilege Escalation

TA0013 — Credential Access

TA0014 — Command and Control

TA0015 — Lateral Movement

TA0000 — AI Model Access (3 plugins)

TA0001 — AI Attack Staging (17 plugins)

TA0002 — Reconnaissance (1 plugin)

TA0003 — Resource Development (1 plugin)

TA0004 — Initial Access (8 plugins)

TA0005 — Execution (8 plugins)

TA0006 — Persistence (6 plugins)

TA0007 — Defense Evasion (17 plugins)

TA0008 — Discovery (9 plugins)

TA0009 — Collection (3 plugins)

TA0010 — Exfiltration (12 plugins)

TA0011 — Impact (57 plugins)

TA0012 — Privilege Escalation (7 plugins)

TA0013 — Credential Access (1 plugin)

TA0014 — Command and Control (1 plugin)

TA0015 — Lateral Movement (0 plugins)

No automated coverage, and no governance questions. Every TA0015 technique is assessed as a gap or as out of scope, so no plugin claims one and the tactic cannot be selected in the scan picker. See the coverage table above for the position on each technique.

AI Model Access & Credential Security

1. Is authentication required for all access to AI model inference APIs?9Y/N
2. Are API keys and credentials for AI services rotated on a defined schedule?8Y/N
3. Are queries to the model restricted by rate, volume, or caller identity?7Y/N
4. Is sensitive data encrypted in transit and at rest when communicating with AI services?8Y/N
5. Is multi-factor authentication enforced for privileged AI system operations?8Y/N
6. Are credential access logs monitored for anomalous patterns?7Y/N

AI Model Integrity & Attack Staging

1. Are model weights and artefacts integrity-checked (checksum or signature) before deployment to production?9Y/N
2. Is write access to model artefacts, training data and fine-tuning pipelines restricted to named individuals and audited?9Y/N
3. Are models scanned for embedded executable content before loading (for example unsafe pickle deserialisation)?8Y/N
4. Is the prompt construction logic (system prompt, templates, retrieval assembly) held in version control with peer review required for changes?8Y/N
5. Is model behaviour benchmarked against a known-good baseline after each retrain or fine-tune, so unexpected shifts are detected?8Y/N
6. Are models tested for backdoor triggers (inputs that produce anomalous behaviour) before release?7Y/N
7. Is white-box access to your models (weights, gradients, architecture) restricted so adversaries cannot optimise attacks offline?7Y/N
8. How mature are your controls over model integrity across the build and deployment pipeline?81–5

Public Exposure & Reconnaissance Surface

1. Is there a review process before staff publish papers, blogs or conference talks describing your AI systems, models or training data?7Y/N
2. Are public code repositories monitored for leaked AI configuration, prompts, API keys or model artefacts?9Y/N
3. Do your public-facing websites and documentation avoid disclosing model identity, version or provider beyond what is required?6Y/N
4. Do you track published vulnerabilities and jailbreaks affecting the specific models and frameworks you deploy?8Y/N
5. Is your organisation's public AI footprint (job adverts, case studies, partner announcements) periodically reviewed for information useful to an attacker?6Y/N
6. Is there a defined owner responsible for reducing the organisation's AI reconnaissance surface?6Y/N
7. How mature is your programme for monitoring and reducing publicly available information about your AI systems?71–5

Adversarial Resource Development

1. Are publicly available AI artefacts (datasets, pre-trained models) vetted for integrity and provenance before use?8Y/N
2. Is AI development infrastructure (workspaces, compute, domains) provisioned through a controlled process with access auditing?7Y/N
3. Are controls in place to detect adversarial prompt crafting attempts that use your LLM to generate attacks against other systems?9Y/N
4. Are retrieval (RAG) content sources validated to prevent adversary-crafted documents from being indexed and served to users?9Y/N
5. Is there monitoring for the publication or distribution of poisoned datasets or models that could target your AI systems?7Y/N
6. Are adversarial AI attack tools and capabilities tracked as part of your threat intelligence programme?6Y/N
7. How mature is your defence against adversaries weaponising your AI system for resource development (prompt crafting, content generation)?71–5

AI Supply Chain Dependencies

1. Do you maintain an AI Bill of Materials covering models, datasets, and software dependencies?9Y/N
2. Are pre-trained models verified for integrity (checksums, signatures) before deployment?9Y/N
3. Are vulnerability scans run against AI framework libraries and dependencies?7Y/N
4. Are third-party data sources and datasets vetted before use in training or fine-tuning?8Y/N
5. Is there a process for restricting and auditing library loading in ML pipelines?7Y/N
6. Are model marketplace downloads (HuggingFace, etc.) scanned for embedded malware or backdoors?8Y/N
7. How mature is your AI supply chain governance programme?71–5

Execution & Agent Security Policies

1. Are there policies preventing LLMs from executing arbitrary commands or scripts without sandboxing?10Y/N
2. Are input validation controls in place to detect and block prompt injection attempts?9Y/N
3. Are AI agent tool invocations subject to permission scoping and approval policies?9Y/N
4. Are there safeguards preventing LLM-generated prompts from being self-replicated or recursively executed?8Y/N
5. Are execution environments for AI workloads isolated from production systems?8Y/N
6. Is there monitoring of LLM-triggered actions for anomalous or unauthorised behaviour?7Y/N

Persistence, Model Integrity & RAG Governance

1. Is training data sanitised and validated before use to prevent data poisoning?9Y/N
2. Are deployed models verified against known-good baselines to detect manipulation?8Y/N
3. Is adversarial training or model hardening applied to improve robustness?7Y/N
4. Are RAG knowledge base contents validated and monitored for poisoning or injection?9Y/N
5. Is there version control and rollback capability for deployed model weights?7Y/N
6. Are fine-tuning pipelines protected against unauthorised data injection?8Y/N
7. How confident are you in the integrity of your model and data pipeline end-to-end?71–5

Evasion Detection & Input Validation

1. Are adversarial input detection mechanisms deployed to identify evasion attempts?8Y/N
2. Are there controls to detect and block LLM jailbreak attempts and prompt obfuscation?9Y/N
3. Are trusted outputs validated to prevent manipulation before being passed to downstream systems?8Y/N
4. Are input restoration or normalisation techniques used to counter obfuscated inputs?7Y/N
5. Is there multi-layer input validation (syntactic, semantic, and contextual)?7Y/N
6. Are model confidence scores monitored for anomalous drops indicating adversarial inputs?7Y/N
7. Is there a feedback loop to update evasion detection rules based on new attack patterns?6Y/N
8. How mature is your adversarial testing programme for AI input validation?71–5

Discovery Prevention & Information Disclosure

1. Is metadata about AI models (version, family, architecture) restricted from public exposure?7Y/N
2. Are model outputs limited to prevent disclosure of system configuration or training details?8Y/N
3. Is there monitoring to detect systematic probing for AI model capabilities or weaknesses?7Y/N
4. Are cloud service endpoints for AI workloads protected against discovery and enumeration?7Y/N
5. Are error messages sanitised to prevent leaking internal model or infrastructure details?8Y/N
6. Is there detection for fingerprinting attempts that map model behaviour patterns?7Y/N
7. How mature are your controls to prevent AI system information disclosure?71–5

AI Artefact & Data Repository Security

1. Are AI model artefacts stored with access controls limiting who can download them?8Y/N
2. Is access to training and evaluation data repositories restricted and audited?8Y/N
3. Are data repositories monitored for unusual bulk downloads or access patterns?7Y/N
4. Is there an inventory of all AI artefacts and their storage locations?7Y/N
5. Are model artefact transfers between environments verified for integrity?7Y/N

Exfiltration Prevention & Data Loss Protection

1. Are there controls to prevent extraction of training data or model parameters via inference API queries?9Y/N
2. Is the system prompt protected against extraction attempts?8Y/N
3. Are outputs monitored for unintended data leakage (PII, confidential data, training examples)?9Y/N
4. Are network-level exfiltration controls (DLP, egress filtering) applied to AI service infrastructure?7Y/N
5. Is there detection for model inversion attacks attempting to reconstruct training data?8Y/N
6. Are watermarking or fingerprinting techniques used to detect unauthorised model copies?8Y/N

Impact Mitigation & Content Safety

1. Are there controls to prevent denial-of-service attacks against AI inference services?8Y/N
2. Is there monitoring and alerting for abnormal cost patterns or resource consumption by AI services?8Y/N
3. Are content safety filters deployed to prevent harmful outputs from reaching end users?9Y/N
4. Are model integrity metrics monitored for signs of degradation or drift from data poisoning?7Y/N
5. Is there an automated rollback mechanism if model performance degrades below acceptable thresholds?6Y/N
6. Are cascading failure scenarios documented and tested for AI-dependent systems?6Y/N
7. How mature is your incident containment process for AI-specific security events?71–5

AI Security Training & Model Lifecycle

1. How mature is your organisation's AI security training programme for developers and operators?81–5
2. Is there a formal model lifecycle process covering development, validation, deployment, and retirement?8Y/N
3. Do you have an AI incident response plan that covers adversarial attacks on models?9Y/N
4. How comprehensively have MITRE ATLAS mitigations (M0000-M0019) been assessed for your AI systems?71–5
5. Is there a regular review cycle for AI security controls aligned to evolving threat landscapes?7Y/N
6. Are AI risk assessments conducted before deploying new models or significant updates?8Y/N
7. Is there an AI governance committee or designated responsible owner for AI security?7Y/N
8. Are third-party AI audits or penetration tests conducted on a regular schedule?6Y/N
9. Is AI model behaviour monitored in production for drift, bias, and anomalous outputs?7Y/N
10. Do decommissioned models and datasets follow a secure disposal process?5Y/N
11. How mature is your AI threat intelligence programme for tracking emerging adversarial techniques?61–5