MITRE Engenuity, Inc., the MITRE Corporation’s tech foundation for the public good, issues all MITRE ATT&CK Defender credentials through the MAD Program.

The MITRE ATT&CK Defender program creates and delivers free online training to help cyber security defenders better adopt and use the MITRE ATT&CK Framework for threat-informed defense; and administers a family of certifications.

Individuals access MAD by purchasing a MITRE ATT&CK Defender Individual Subscription for a $499 USD annual fee.

We launched MAD with a provocatively low price to bring as many new people into the ATT&CK fold as possible. The downside of what we’re doing, both to maintain the existing content and do all the exciting new stuff is that we had to look at the costs to do and support it. Our goals are still the same as before – provide excellent training on core ATT&CK-based methodologies for free to the community and provide a path to earn unique Living Certifications to prove your mastery of the skills to the world. To support the development of the new content, assessments, labs, and hosting, we will be raising the annual subscription price from the introductory price of $299/year to $499/year (USD).

View some additional questions and answers  you might have on the topic.

To learn more about enterprise licenses, please complete this form.

ATT&CK Cyber Threat Intelligence

ATT&CK Security Operations Center Assessment

ATT&CK Adversary Emulation Methodology

ATT&CK Threat Hunting and Detection Engineering 

ATT&CK Purple Teaming Methodology 

The certification affirms that the individual has met MITRE Engenuity’s definition of real-world mastery, knowledge, and proficiency in the application of MITRE ATT&CK® in a particular subject matter.

MITRE ATT&CK Defender certifications bring a new approach to certifications in the cyber security industry. Certifications only require learners to pass a series of assessments to earn current badges. Each certification is automatically awarded to learners who earns the required badges for that certification. Each badge requires the learner to demonstrate mastery of a specific set of topics within the subject matter.

Learners must earn a passing score for each assessment (typically 80 percent). Once a learner passes an assessment, they are issued a badge affirming mastery of the application of ATT&CK® in that set of topics.

ATT&CK Fundamentals
ATT&CK Cyber Threat Intelligence from Narrative Reporting
ATT&CK Cyber Threat Intelligence from Raw Data
ATT&CK Cyber Threat Intelligence Storage and Analysis
ATT&CK Cyber Threat Intelligence Defensive Recommendations
ATT&CK Security Operations Center Assessment Fundamentals
ATT&CK Security Operations Center Assessment Analysis
ATT&CK Security Operations Center Assessment Synthesis
ATT&CK Adversary Emulation Fundamentals
ATT&CK Adversary Emulation TTP Research
ATT&CK Adversary Emulation Planning
ATT&CK Adversary Emulation TTP Implementation
ATT&CK Adversary Emulation Execution
ATT&CK Threat Hunting Fundamentals
ATT&CK Threat Hunting Hypotheses
ATT&CK Threat Hunting Data Collection Requirements
ATT&CK Threat Hunting Addressing Data Collection Gaps 
ATT&CK Threat Hunting Tuning Analytics 
ATT&CK Purple Teaming Fundamentals 

Practitioners gain knowledge and skill by watching the MAD online training courses available through our partner Cybrary.

ATT&CK® Fundamentals
Mapping to ATT&CK® from Narrative Reporting
Mapping to ATT&CK® from Raw Data
Storing and Analyzing ATT&CK®-mapped Intelligence
Making ATT&CK®-mapped Data Actionable with Defensive Recommendations
Overview of ATT&CK®-based SOC Assessments
Analyzing SOC Components with ATT&CK®
Synthesizing SOC Assessments