Join the community of Certified MITRE ATT&CK® Defenders who have proven their real-world mastery in applying the knowledge of adversary behaviors to improve security configurations, analytics and decision-making.

One year of unlimited access to ATT&CK badges and certifications – USD 499


What is MAD?

MITRE ATT&CK Defender (MAD) is a program run by MITRE Engenuity, Inc. that includes the MAD product that provides access to ATT&CK® education and certifications.

Who issues MAD credentials?

MITRE Engenuity, Inc., the MITRE Corporation’s tech foundation for the public good, issues all MITRE ATT&CK Defender credentials through the MAD Program.

What does the MAD Program do?

The MITRE ATT&CK Defender program creates and delivers free online training to help cyber security defenders better adopt and use the MITRE ATT&CK Framework for threat-informed defense; and administers a family of certifications.

How much does it cost to access MAD?

Individuals access MAD by purchasing a MITRE ATT&CK Defender Individual Subscription for a $499 USD annual fee.

Why was there a price increase for MAD?

We launched MAD with a provocatively low price to bring as many new people into the ATT&CK fold as possible. The downside of what we’re doing, both to maintain the existing content and do all the exciting new stuff is that we had to look at the costs to do and support it. Our goals are still the same as before – provide excellent training on core ATT&CK-based methodologies for free to the community and provide a path to earn unique Living Certifications to prove your mastery of the skills to the world. To support the development of the new content, assessments, labs, and hosting, we will be raising the annual subscription price from the introductory price of $299/year to $499/year (USD).


View some additional questions and answers you might have on the topic.

Are enterprise licenses available?

To learn more about enterprise licenses, please complete this form

What certifications can I earn?

ATT&CK® Cyber Threat Intelligence
ATT&CK® Security Operations Center Assessment

What does a certification prove to the industry?

The certification affirms that the individual has met MITRE Engenuity’s definition of real-world mastery, knowledge, and proficiency in the application of MITRE ATT&CK® in a particular subject matter.

How do I earn the certifications?

MITRE ATT&CK Defender certifications bring a new approach to certifications in the cyber security industry. Certifications only require learners to pass a series of assessments to earn current badges. Each certification is automatically awarded to learners who earns the required badges for that certification. Each badge requires the learner to demonstrate mastery of a specific set of topics within the subject matter.

What score do I need to pass an Assessment?

Learners must earn a passing score for each assessment (typically 80 percent). Once a learner passes an assessment, they are issued a badge affirming mastery of the application of ATT&CK® in that set of topics.

What Badges can I earn?

ATT&CK® Fundamentals
ATT&CK® Cyber Threat Intelligence from Narrative Reporting
ATT&CK® Cyber Threat Intelligence from Raw Data
ATT&CK® Cyber Threat Intelligence Storage and Analysis
ATT&CK® Cyber Threat Intelligence Defensive Recommendations
ATT&CK® Security Operations Center Assessment Fundamentals
ATT&CK® Security Operations Center Assessment Analysis
ATT&CK® Security Operations Center Assessment Synthesis

How can I prepare for the certifications?

Practitioners gain knowledge and skill by watching the MAD online training courses available through our partner Cybrary.

What online training courses are available?

ATT&CK® Fundamentals
Mapping to ATT&CK® from Narrative Reporting
Mapping to ATT&CK® from Raw Data
Storing and Analyzing ATT&CK®-mapped Intelligence
Making ATT&CK®-mapped Data Actionable with Defensive Recommendations
Overview of ATT&CK®-based SOC Assessments
Analyzing SOC Components with ATT&CK®
Synthesizing SOC Assessments

Subscribe to the Quick ATT&CK Facts Newsletter