MITRE ATLAS for AI red teaming: tactics, techniques, mitigations and case studies

Why this page: the site compares red-teaming requirements for defense programs, red-teaming tools and NIST AI 100-2 terms. It had no page on the knowledge base most red-team reports cite for attack names: MITRE ATLAS. Everything below comes from the public data repository and the 2026.09 data file we fetched, not from the ATLAS web application, which renders in the browser.

What ATLAS is, in MITRE’s words

The repository README says the data is for MITRE ATLAS™ (Adversarial Threat Landscape for AI Systems), a public knowledge base of adversary TTPs targeting AI systems. The public site is at atlas.mitre.org. The README also says ATLAS releases monthly content updates, with a content version in the form YYYY.MM.N.

What the 2026.09 data file contains

The file’s collection block records version: ‘2026.09’ and a modified-date: ‘2026-09-15’. Counting object-type entries in that file, we found 16 tactics, 208 techniques, 40 mitigations and 73 case studies. That count is our own tally of the file, not a figure MITRE states; it will change with each monthly release.

The README’s ID conventions are Tactic ID: AML.TA####, a technique ID of the form AML.T####, a mitigation ID of the form AML.M#### and a case-study ID of the form AML.CS####. The relationship types it lists include mitigates: mitigation -> technique and employs: case study -> technique. Those typed links are what make ATLAS usable as a test-plan index.

The tactics in the file include AI Model Access, AI Attack Adaptation, Reconnaissance, Resource Development, Initial Access, Execution, Defense Evasion, Exfiltration and Impact. The Impact tactic is described as The adversary is trying to manipulate, interrupt, erode confidence in, or destroy your AI systems and data.

Mitigation names in the file include Validate AI Model, AI Red Team, Maintain AI Dataset Provenance, AI Bill of Materials and Human In-the-Loop for AI Agent Actions. The mitigation Limit Public Release of Information says to Limit the public release of technical information about the AI stack used in an organization’s products or services.

Tooling the repository ships

The README says the repository includes command-line tooling to populate ATLAS YAML into the database and generate additional distribution formats (STIX, Navigator layers, Excel). A red-team lead can export the matrix to a spreadsheet and tag each test case with a technique ID.

How a red team can use it (editorial judgment)

This section is the site’s judgment, not MITRE’s.

1. Name findings with ATLAS IDs. A finding tagged with a technique ID can be compared across programs and reports.
2. Seed the test plan from case studies. The employs links tie a case study to techniques, so a plan can start from incidents and exercises that were actually documented.
3. Close the loop with mitigations. The mitigates links point from a mitigation to the techniques it addresses. A finding with no mapped mitigation is a gap worth recording.
4. Do not treat coverage as assurance. ATLAS is a knowledge base. Testing every technique does not show a system is safe for an airborne or DoD purpose. The DoD red-teaming article covers what programs actually ask for.

Questions

Is ATLAS a standard or a certification?

Neither source we fetched says so. The README describes it as a public knowledge base. Nothing there makes ATLAS a certification scheme or a means of compliance.

Where does it sit next to NIST AI 100-2?

NIST AI 100-2 is a taxonomy and terminology document; ATLAS is a matrix of tactics, techniques, mitigations and case studies. See NIST AI 100-2 adversarial ML terms for the NIST side and the listing for MITRE ATLAS.