Framework

MITRE Engage
a planning framework for adversary engagement, deception, and denial

MITRE Engage is the adversary engagement, deception, and denial planning framework, organised around three goals (Expose, Affect, Elicit) and five activity classes (Prepare, Collect, Detect, Prevent, Direct). Where MITRE ATT&CK catalogues offensive techniques and MITRE D3FEND catalogues defensive countermeasures, Engage sits on the strategy layer above both and gives adversary engagement a per-engagement, per-adversary operating shape. SecPortal operates a MITRE Engage engagement as one structured record across the threat model, the operating environment, the Direct-stage operating posture, and the engagement-time interactions.

Get Started Free

No credit card required. Free plan available forever.

MITRE Engage: a planning framework for adversary engagement, deception, and denial

MITRE Engage is a planning framework for adversary engagement, deception, and denial. It gives security teams a structured way to think about how a defensive estate can be operated so adversary behaviour is surfaced earlier, shaped during the engagement, and converted into durable threat intelligence at engagement close. Where MITRE ATT&CK catalogues offensive techniques and MITRE D3FEND catalogues defensive countermeasures, MITRE Engage sits on the strategy layer above both and answers the operating question of how the defence should engage the adversary across three goals (Expose, Affect, Elicit) and five activity classes (Prepare, Collect, Detect, Prevent, Direct). Engage absorbs and supersedes the earlier MITRE Shield active-defence matrix as the maintained reference.

For detection engineering teams, threat intelligence and threat hunting teams, incident response and SOC teams, security engineering and platform teams owning the decoy infrastructure, security architecture teams designing the operating environment that makes the engagement plausible, AppSec and product security teams handing off adversary observations to the operating defensive estate, GRC and compliance teams reading detection-and-response evidence against NIST CSF 2.0, NIST SP 800-53, ISO 27001, SOC 2, PCI DSS, CIS Controls, DORA, and NIS2, and CISOs carrying the board risk-committee read on adversary-engagement coverage, MITRE Engage is the strategic operating frame the engagement record reads against. The value is the planning structure that turns adversary engagement from a per-tool exercise into a per-engagement, per-adversary operating record.

This page covers how Engage is structured (three goals, five activity classes, the Engage matrix), how the pairing with ATT&CK and D3FEND works mechanically, how to run an adversary-engagement programme end to end, where Engage sits next to ATT&CK, D3FEND, MITRE Shield, MITRE CALDERA, NIST CSF 2.0, and honeypot tools, the audience read for detection engineering, threat intelligence, incident response, security engineering, GRC, and CISO functions, the framework crosswalk the same engagement record satisfies, and how SecPortal operates a MITRE Engage engagement as one structured record.

The three Engage goals

Engage organises adversary-engagement strategy across three top-level goals, each named for what the defensive estate is trying to accomplish against the adversary at that step. The goals are not severity-ranked; they are objective-ranked against the operating shape of an adversary-engagement programme, and a single Engage activity often reads against more than one goal. The goals give the framework its navigable shape; the activities underneath each goal give the per-engagement evidence the operating record reads against.

ExposeEngage goal

Surface adversary activity early enough to act on it. Expose activities reveal the operator who is already inside or attempting to enter the environment, before the attacker reaches the objective. Detection, hunting, and decoy-driven observation feed this goal. Expose answers the operating question of whether the defence sees what the offence is doing.

AffectEngage goal

Shape adversary decisions by changing the operating environment in a way the operator must respond to. Affect activities slow the operator down, force a tooling change, or burn the operator time on an unproductive path. Decoy systems, lure objects, and reaction-shaping operations sit here. Affect answers the operating question of whether the defence can interfere with the offensive plan.

ElicitEngage goal

Draw out information about adversary tradecraft, motivation, intent, and operating constraints. Elicit activities run the engagement long enough to learn something about the operator that the threat model can consume. Sustained decoy interaction, controlled disclosure, and instrumented response sit here. Elicit answers the operating question of whether the defence is converting the engagement into durable threat intelligence.

The five activity classes underneath the goals

Engage organises the per-engagement operating layer across five activity classes that anchor the planning, the baseline, the observation, the hardening, and the deliberate environmental change underneath the three goals. The activity classes give the engagement a temporal shape (Prepare and Collect happen before any adversary interaction; Detect runs continuously; Prevent runs against the precondition surface; Direct is the visible operating layer the goals are anchored to) and the engagement record reads against named activities rather than against abstract goal-level claims.

Prepare: scope the engagement against a named threat model, define the operating environment, name the legal authority, name the engagement owner, and capture the success criteria before any adversary interaction. The Prepare stage produces the engagement charter the rest of the engagement reads against; skipping it converts the engagement into ad hoc theatre.
Collect: gather the offensive and defensive baseline that the rest of the engagement reads against. Collect the threat-intelligence picture for the named adversary, the current detection content inventory, the asset and identity context, the legitimate-user behaviour baseline, and the prior-engagement record. The Collect stage produces the operating context every Affect and Elicit activity is anchored to.
Detect: see adversary activity in operating data. Detect activities turn the agreed telemetry surface, the analytics, and the threat-hunting routine into a continuous observation surface against the named adversary. The Detect stage is where the Engage strategy reads against the detection engineering output, the SIEM content catalogue, the EDR analytic catalogue, and the NDR analytic catalogue.
Prevent: harden the environment so the named adversary actions cannot succeed against the operating estate as deployed. Prevent activities address the precondition the offensive technique relies on, not the technique itself. The Prevent stage reads against the patch baseline, the configuration baseline, the identity hardening surface, and the network segmentation policy.
Direct: shape adversary decisions through deliberate environmental change. Direct activities sit underneath the Affect and Elicit goals and are the visible operating layer of an Engage programme. Decoy systems, decoy objects, decoy credentials, lure files, lure mailboxes, lure cloud roles, and constrained operating environments sit here. The Direct stage produces the engagement-time interaction record the post-engagement analysis reads against.

The Engage matrix and the pairing with ATT&CK and D3FEND

Engage is a planning matrix, not a checklist, and the pairing with the other MITRE knowledge bases happens at the strategy-and-technique level. Naming the join surface is the difference between an engagement record that survives an architectural review and one that does not. The mechanic below is the structural pairing the matrix supports; tag accordingly so the engagement record reads against the full MITRE family at once.

Engage approaches at the goal level (Expose, Affect, Elicit) are the strategic frame the engagement reads against.
Engage activities at the next level down break each goal into named operating activities: Reassure, Motivate, Disrupt, Negate, Detect, Collect, Prevent, Direct, and others depending on the matrix revision.
Engage activities pair to ATT&CK technique categories at the artefact level, not at the textual name level. A decoy-environment activity reads against ATT&CK Reconnaissance, Discovery, Collection, and Lateral Movement techniques that consume decoy artefacts; a lure-object activity reads against the Credential Access, Discovery, and Collection techniques that consume lure artefacts.
Engage approaches also pair to the D3FEND Deceive tactic (D3-DE Decoy Environment, D3-DO Decoy Object, D3-DU Decoy User), the D3FEND Isolate tactic (D3-EI Execution Isolation, D3-NI Network Isolation, D3-AI Account Isolation), the D3FEND Detect tactic, and the D3FEND Harden tactic. Engage is the strategy layer; D3FEND is the per-technique countermeasure catalogue underneath.
Engage is versioned. The matrix is refreshed as the discipline matures, and the per-engagement record should name the matrix version it ran against so the post-engagement read is reproducible.
Engage carries an explicit ethics and proportionality stance. Activities that mislead, contain, or burn adversary resources must be planned with legal authority, scope clarity, and incident-handling boundaries that prevent the engagement from blurring into entrapment or affecting non-target users.

Planning principles that survive contact with the adversary

Most adversary-engagement programmes start strong on framework fidelity and decay because engagement design happens against a generic adversary and the operating posture is set up and torn down per exercise. By then the cycle-over-cycle signal is gone, the plausibility of the operating posture has drifted, and the engagement record ends up as a one-time report rather than a durable artefact. Build the discipline into the engagement charter so the operating record is derived from named-adversary work, not from improvisation.

An Engage programme is paired to a named threat model. The matrix is too rich to operate against a generic adversary, and the engagement record loses meaning if the adversary is not specified. Start from a documented threat actor profile, a documented threat scenario, or an emerging-CVE worth a target adversary, and let the threat model select the Engage activities rather than the other way around.
Approach selection is anchored to the operating environment. A decoy environment that does not match the legitimate environment is a tell that an experienced operator will read in minutes. The decoy infrastructure, the decoy identities, the decoy data, and the decoy activity pattern need to be plausible against the real estate or the engagement turns into observable theatre.
Engage activities sit alongside production operations, not on top of them. Decoy systems live on the operating network, decoy users live in the identity catalogue, decoy data lives in real data stores. The engagement is a long-running, controlled operating posture rather than an exercise that is set up and torn down per week. The longer the operating posture is stable, the more meaningful the engagement-time data the post-engagement analysis reads.
Every Engage activity has named scope, named legal authority, named operating owner, named on-call route, and named pause condition. Activities that mislead an adversary need the same operating discipline a controlled penetration test needs, with the additional discipline that the engagement may surface law-enforcement-relevant evidence that must be handled accordingly.
The Engage operating record is per-engagement and per-activity, not per-quarter. Each adversary interaction event is recorded against the engagement, with the activity that was running, the asset the interaction landed on, the artefact that was touched, the detection signal that fired, the analyst response, the analyst decision, and the outcome. The engagement record is the artefact the post-engagement review reads against.
Engage is paired with the existing detection engineering, threat intelligence, and incident response programmes. The engagement is not a separate organisational unit; the detection engineering team owns the analytics the Detect activities read against, the threat intelligence team owns the adversary profile the Prepare activities read against, the incident response team owns the playbooks the live engagement-time interactions read against. Engage is the framework on top of the existing programmes, not a replacement for them.

Running an adversary-engagement programme end to end

Adversary-engagement work benefits from MITRE Engage even when the engagement is a single application scope, a single network segment, or a single operating-system class. The matrix gives the work a structure that connects the named threat model, the named operating environment, the Direct-stage operating posture, and the engagement-time interactions on one record. The workflow below assumes the engagement is run as a structured project on SecPortal rather than a collection of ad-hoc artefacts. For the operational ground covered alongside engagement at exercise time, the purple team operations workflow applies the same per-action evidence discipline with the detection outcome captured inline.

Charter the engagement against a named threat model

Pair the agreed threat actor profile, the agreed threat scenario, or the agreed emerging-CVE-driven adversary with the named operating environment the engagement runs against. Capture the legal authority, the engagement scope, the named operating owner, the on-call route, the pause condition, and the success criteria as the engagement charter. SecPortal carries the engagement record as a structured artefact with named scope, named owner, named contact, and named timeline so the Engage charter has a single source of truth rather than living in slide decks and email threads.

Collect the operating baseline the engagement reads against

Capture the current detection content inventory, the current asset inventory, the current identity catalogue, the current network segmentation map, the current user-behaviour baseline, and the threat-intelligence picture for the named adversary. The operating baseline is the surface the Engage activities read against and is what changes during the engagement; without the baseline the post-engagement analysis cannot say what the engagement changed.

Stand up the Direct-stage operating posture

Provision the decoy systems, the decoy objects, the decoy identities, the lure files, the lure credentials, the lure mailboxes, and the lure cloud roles that the Engage strategy calls for. The Direct-stage operating posture must look like the legitimate estate, be reachable through the same paths the legitimate estate is reachable through, and behave like the legitimate estate up to the engagement boundary. The provisioning record sits on the engagement so the post-engagement teardown is a known operation.

Run Detect-stage observation against the operating posture

Operate the agreed analytics catalogue, the agreed threat hunts, and the agreed SOC routines against the Direct-stage operating posture and against the rest of the estate. Every detection signal that reads against a decoy artefact, a lure artefact, or a constrained operating environment is captured against the engagement record as a finding. Findings are categorised at engagement time with named adversary action, named asset, named artefact, named analyst, and named decision, not reconstructed at report time.

Operate Affect and Elicit activities under controlled escalation

When adversary activity touches the Direct-stage operating posture, the engagement transitions to live operations. Affect activities shape adversary decisions (slowing the operator down, forcing a tooling change, burning the operator on unproductive paths). Elicit activities draw out adversary tradecraft, motivation, intent, and operating constraints. Each activity is logged against the engagement with the named activity, the named asset, the named artefact, the named analyst, the named decision, the named outcome, and the named escalation path.

Close the engagement and read the post-engagement analysis

At engagement close, read the engagement record against the threat model, the operating baseline, the detection content inventory, the asset inventory, the identity catalogue, the network segmentation policy, and the next-cycle threat-intelligence picture. Produce the engagement report against the original charter and the engagement-time interactions, with named findings, named lessons, and named next-cycle activities. SecPortal AI-assisted reports compose the engagement narrative from the live engagement, findings, and per-finding adversary-action tags without re-keying the matrix into a document.

Routines that read against the Engage matrix

Engage is closest to its operational shape during the recurring routines that read the adversary-engagement posture against the threat model. The routines below all read against the same engagement record on SecPortal; the value comes from the cycle-over-cycle comparison the engagement record supports.

Adversary engagement cycles paired to documented threat actor playbooks (G-group profiles in MITRE ATT&CK) that exercise the Direct-stage operating posture against the named adversary
Detection engineering test cycles that read the Detect-stage analytics inventory against the operating record and update the detection content catalogue based on engagement-time signals
Threat intelligence enrichment cycles that consume the Elicit-stage adversary observations and refresh the next-cycle threat model, threat scenarios, and named adversary profile
Incident response runbook updates that consume the engagement-time interaction record and refresh the playbooks the live engagement-time interactions read against
Cross-engagement review cycles that read the cycle-over-cycle engagement record to measure how the Engage operating posture is changing the adversary path, the analyst workload, the detection content quality, and the threat intelligence picture
Annual programme review that scores the Engage operating posture against the threat model, the detection content inventory, the asset inventory, the identity catalogue, the network segmentation policy, and the next-cycle threat-intelligence picture

Recurring failure modes that weaken an Engage record

Programmes that struggle with Engage typically hit a small set of recurring failure modes. Naming the failure modes up front lets the engagement design controls to avoid them rather than discovering them during the report review or the audit fieldwork.

Treating MITRE Engage as a single-product deception tool rather than as a strategic operating framework. The matrix is a planning artefact that the deception platform implements one piece of, not a competing product. Programmes that read Engage as a vendor checklist lose the strategic depth and produce an engagement record the post-engagement review reads as theatre.

Standing up decoy infrastructure that does not match the legitimate operating environment. A decoy that an experienced operator can read as a decoy in minutes is worse than no decoy at all because the operator updates the threat model and the next-cycle engagement becomes harder, not easier. Plausibility is the first cost of an Engage programme.

Running the engagement against a generic adversary rather than a named threat model. The matrix is too rich to operate generically; the engagement record cannot read against a moving definition of who the adversary is. Pair every engagement to a documented threat actor profile, scenario, or emerging-CVE-driven adversary before any Direct-stage provisioning.

Operating Affect and Elicit activities without an explicit escalation path. The moment a live adversary interacts with the Direct-stage operating posture, the engagement transitions to live operations and the incident response routine must be ready. Programmes that lack the escalation path improvise at the wrong moment and lose the engagement-time evidence the post-engagement analysis reads against.

Confusing Engage with entrapment or with affecting non-target users. Engage activities mislead, contain, or burn adversary resources. Activities that affect the legitimate user population, the contracted third-party population, or persons outside the legal authority for the engagement violate the proportionality stance the framework expects and convert the engagement from a defensive operation into a legal liability.

Recording adversary interactions in scattered analyst notes rather than on the engagement record. The post-engagement analysis depends on a per-interaction, per-artefact, per-analyst record that survives the engagement and feeds the next-cycle threat model. Programmes that file interactions in chat threads, email subjects, or per-tool dashboards lose the artefact the discipline reads against.

Treating Engage as a one-time exercise rather than as a long-running operating posture. The discipline rewards the cycle-over-cycle read more than any single engagement. A decoy that stays in place for a quarter and observes adversary activity over that quarter produces operating-record signal a one-week exercise cannot produce.

Skipping the Prepare stage and improvising the charter as the engagement progresses. The charter is the artefact every Affect, Elicit, and Direct activity reads against; engagements without a charter lose the ability to score themselves against intent and produce post-engagement reads that argue against the original purpose.

How Engage sits next to ATT&CK, D3FEND, Shield, CALDERA, NIST CSF 2.0, and honeypot tools

Engage is rarely used in isolation. It is the per-engagement strategy layer that the offensive knowledge base, the defensive countermeasure graph, the outcome-oriented framework, the test-execution platform, and the implementation-side honeypot tools all read into. The contrast below is a working view, not a buyer comparison: the practitioner question is which artefacts to pair Engage with, not which to pick instead of it.

MITRE Engage vs MITRE ATT&CK

ATT&CK is the offensive technique knowledge base catalogue: tactics, techniques, sub-techniques, and procedures observed in real intrusions. Engage is the adversary engagement, deception, and denial planning framework that sits on the strategy layer above the technique catalogue. ATT&CK answers "what did the attacker do"; Engage answers "what should the defence do to influence what the attacker does next". Programmes pair the two with ATT&CK as the per-technique catalogue the Engage activities read against on the offensive side.

MITRE Engage vs MITRE D3FEND

D3FEND is the defensive countermeasure knowledge graph paired with ATT&CK at the Digital Artefact level. Engage is the engagement strategy layer that sits above the countermeasure catalogue and reads against D3FEND techniques on the implementation side. The D3FEND Deceive tactic (D3-DE Decoy Environment, D3-DO Decoy Object, D3-DU Decoy User) is the per-technique catalogue the Engage Direct-stage activities read against; the D3FEND Isolate tactic gives Engage Affect-stage activities their containment surface; the D3FEND Detect tactic gives Engage Detect-stage activities their analytic surface.

MITRE Engage vs the MITRE Shield archive

MITRE Shield was the predecessor active defence matrix published by MITRE between 2020 and 2022 that catalogued opportunities, use cases, and techniques for active defence against adversaries. Engage absorbs and supersedes Shield as the maintained framework for adversary engagement, deception, and denial strategy. Programmes that reference Shield artefacts should migrate to the equivalent Engage activities, with the Engage matrix being the current operating reference.

MITRE Engage vs MITRE CALDERA

CALDERA is the open-source adversary emulation platform that operationalises ATT&CK techniques in a test environment. Engage is the strategy framework for engaging actual adversaries through deliberate environmental change. CALDERA produces test-time execution records against a simulated adversary; Engage produces engagement-time interaction records against a real adversary interacting with the operating estate. Programmes use CALDERA on the test side and Engage on the operating side; the two read against each other but do not replace each other.

MITRE Engage vs NIST CSF 2.0

NIST CSF 2.0 is the outcome-oriented cybersecurity framework with six functions (Govern, Identify, Protect, Detect, Respond, Recover). Engage is the strategy framework for adversary engagement that produces Detect (DE.AE, DE.CM) function evidence and Respond (RS.AN, RS.MA, RS.CO) function evidence on the operating estate. CSF asks "is the outcome present"; Engage gives the detection and response cycle a strategic shape underneath that outcome read.

MITRE Engage vs honeypot tools

Honeypot tools (T-Pot, Cowrie, Conpot, Dionaea, Glastopf, OpenCanary, Canarytokens, Thinkst Canary, decoy services on the cloud platforms) are the implementation layer that puts a decoy system, decoy object, or decoy user in the operating estate. Engage is the strategy layer that decides which decoy to deploy where, for which adversary, with which legal authority, against which threat model. Programmes typically run honeypot tools as the implementation underneath an Engage strategy rather than as an Engage substitute.

Buyers procuring an adversary-engagement programme should pair the Engage operating record with MITRE ATT&CK as the offensive technique catalogue the engagement reads against, with MITRE D3FEND as the per-technique defensive countermeasure catalogue the Engage activities implement against, with continuous threat exposure management as the programme discipline the engagement reads through, with CREST and TIBER-EU as the assurance frameworks the threat-led testing cycle reads against, and with the threat modelling guide on the planning side.

How auditors and regulators read an Engage citation

Engage is not itself a regulator-issued standard; it is the open adversary-engagement strategy framework that regulator-issued standards, audit frameworks, and procurement processes accept as the per-engagement evidence record for detection-and-response work. The list below maps Engage to the regulator-side and audit-side references that read against it; the same engagement record satisfies several reads at once when the per-activity evidence is honest.

NIST CSF 2.0 functions Detect (DE.CM Continuous monitoring, DE.AE Anomalies and events) and Respond (RS.AN Incident analysis, RS.MA Incident management, RS.CO Incident response communications): MITRE Engage gives the per-engagement adversary-interaction record the CSF outcome categories read against.
NIST SP 800-53 Rev 5 SI-4 (Information system monitoring), CA-7 (Continuous monitoring), IR-4 (Incident handling), IR-5 (Incident monitoring), AU-12 (Audit record generation), and SC-26 (Decoys): the SC-26 control names decoy systems explicitly as a control class, and MITRE Engage is the framework the operating evidence underneath SC-26 reads against.
ISO/IEC 27001:2022 Annex A 5.7 (Threat intelligence), A 5.24 (Information security incident management planning and preparation), A 5.25 (Assessment and decision on information security events), A 8.16 (Monitoring activities), A 8.20 (Networks security), A 8.21 (Security of network services): MITRE Engage is the strategy framework auditors read against the ISMS-in-scope adversary-engagement evidence.
SOC 2 Trust Services Criteria CC7.1 (Detection of unauthorised actions), CC7.2 (Incident response evaluation), CC7.3 (Incident response communication), CC7.4 (Response to security incidents): MITRE Engage activities produce per-engagement adversary-interaction records the SOC 2 auditor reads on the operating estate.
PCI DSS Requirement 10 (Log and monitor all access), Requirement 11.5 (Intrusion detection and prevention), and Requirement 12.10 (Incident response plan): MITRE Engage gives the per-engagement adversary-interaction record the QSA reads against the cardholder-data environment detection-and-response evidence.
CIS Controls v8.1 Control 13 (Network monitoring and defence) Safeguards 13.1 through 13.11 and Control 17 (Incident response management) Safeguards 17.1 through 17.9: MITRE Engage gives the strategic frame the technical safeguards underneath Control 13 and Control 17 read against.
NIST SP 800-30 (Guide for conducting risk assessments), NIST SP 800-160 Volume 1 (Engineering trustworthy secure systems), NIST SP 800-160 Volume 2 (Developing cyber-resilient systems): MITRE Engage gives a structured shape to the cyber resiliency engineering and adversary-aware risk assessment disciplines.
DORA Article 9 (ICT security policies), Article 10 (Detection), Article 11 (Response and recovery), Article 13 (Learning and evolving), and Article 17 (ICT-related incident management): MITRE Engage gives the per-engagement record the financial-entity supervisory authority reads against the detect-and-respond evidence on in-scope ICT services.
NIS2 Article 21 paragraph 2 (b) (incident handling), paragraph 2 (a) (policies on risk analysis and information system security), and Article 23 (Reporting obligations): MITRE Engage gives the per-engagement adversary-interaction record the competent authority reads against essential and important entity detection-and-response estates.
NIST AI Risk Management Framework (AI RMF 1.0) Map, Measure, and Manage functions and the Generative AI Profile: MITRE Engage activities applied to AI-system adversarial-input observation (prompt injection, indirect prompt injection, model extraction attempt, training data poisoning attempt) supply the per-engagement adversarial-interaction record the AI RMF Measure function reads against.

For the broader audit-evidence story (how the same finding can satisfy multiple regulator reads without rebuilding the evidence pack per audit), see the vulnerability evidence reuse across audits research and the multi-framework control crosswalk economics research. The validation discipline that reads outputs from Engage-tagged exercises is covered in the control validation vs detection validation pairing research.

The Engage read across detection-and-response functions

Engage is a cross-functional artefact. The same engagement record reads differently depending on which function holds the work. Programmes that run adversary engagement as a SOC exercise alone lose the architectural depth the framework supports; programmes that run it as a CISO scorecard alone lose the engineering depth. The named functions below own different parts of the same per-engagement operating record.

Detection engineering teams

Detection engineering teams use MITRE Engage as the strategic operating frame each new analytic, each new rule, and each new content pack is paired to. A new SIEM rule is no longer a generic detection; it is a Detect-stage analytic that reads against a named adversary action, the named ATT&CK technique, the named D3FEND defensive technique, and the named Engage activity the analytic supports. The framework gives the discipline a per-engagement shape the analyst workload and the analytic catalogue can be planned against.

Threat intelligence and threat hunting teams

Threat intelligence and threat hunting teams use MITRE Engage as the operating cycle the threat model feeds and the engagement-time observations feed back. The intelligence picture for the named adversary feeds the Prepare and Collect stages; the engagement-time Elicit-stage observations refresh the next-cycle threat model; the engagement-time Affect-stage observations inform the next-cycle defensive posture. Engage is the discipline that converts threat intelligence from a static document into an operating record.

Incident response and SOC teams

Incident response and SOC teams use MITRE Engage as the discipline that runs alongside the live incident response routine. When a live adversary interacts with the Direct-stage operating posture, the engagement transitions to live operations and the SOC runbook is ready. Engage gives the live engagement-time interaction a structured record the after-action review reads against and the next-cycle playbook update reads from.

Security engineering, security architecture, and platform teams

Security engineering, security architecture, and platform teams use MITRE Engage as the strategy framework that drives the operating-environment design choices that make the Direct-stage operating posture plausible. The decoy infrastructure, the decoy identities, the decoy data, the lure files, the lure credentials, the lure cloud roles, and the constrained operating environments are platform-engineering products that the named engineering teams own and operate.

GRC and compliance teams reading detection-and-response evidence

GRC and compliance teams use MITRE Engage as the per-engagement evidence artefact that maps to NIST CSF 2.0 Detect and Respond functions, NIST SP 800-53 Rev 5 SI-4 and SC-26, ISO 27001 Annex A 5.7, A 5.24, A 5.25, A 8.16, A 8.20, and A 8.21, SOC 2 CC7, PCI DSS Requirement 10, 11.5, and 12.10, CIS Controls v8.1 Control 13 and Control 17, DORA Article 9, 10, 11, 13, and 17, and NIS2 Article 21 paragraph 2 and Article 23. The team consumes the per-engagement record on the workspace rather than rebuilding the evidence pack per audit, with the framework crosswalk reading once into multiple regulator reads.

CISOs, security directors, and security program owners

CISOs and security directors use MITRE Engage as the strategic narrative the board risk-committee and audit-committee reads run against on adversary engagement. The leader-side question is which named adversaries the programme has engaged, which Engage activities the operating estate runs, which engagement-time interactions the programme has captured, and which next-cycle activities the threat-intelligence refresh has named. The framework gives the answer a structured shape and the year-on-year comparison reads against named adversary profiles, not a moving definition of detection coverage.

The persona-specific entry points are SecPortal for detection engineering teams, SecPortal for security engineering teams, SecPortal for incident response leads, SecPortal for internal security teams, SecPortal for security architects, and SecPortal for CISOs. Each anchors a different view of the same MITRE Engage engagement record.

Adjacent MITRE and threat-engagement references

Engage reads alongside several other MITRE and threat-engagement references. Each one covers a different slice of the operating model; Engage is the per-engagement strategy artefact that converts the references into a verifiable adversary-engagement record.

MITRE Engage and MITRE ATT&CK

ATT&CK is the offensive technique knowledge base catalogue paired with Engage on the strategy side. Engagements cite the ATT&CK version and the Engage matrix version together so the per-engagement record is reproducible against versioned references. Every Engage activity reads against a named ATT&CK technique scope on the offensive side, and every adversary interaction during the engagement carries the ATT&CK technique tag alongside the Engage activity tag.

MITRE Engage and MITRE D3FEND

D3FEND is the per-technique defensive countermeasure knowledge graph that the Engage activities read against on the implementation side. The D3FEND Deceive tactic supplies the per-technique catalogue the Engage Direct-stage activities implement; the D3FEND Isolate tactic supplies the containment surface the Engage Affect-stage activities operate against; the D3FEND Detect tactic supplies the analytic surface the Engage Detect-stage activities read against; the D3FEND Harden tactic supplies the precondition surface the Engage Prevent-stage activities address.

MITRE Engage and continuous threat exposure management

Continuous threat exposure management (CTEM) is the programme-level exposure-management discipline that the Engage operating posture reads through. CTEM gives the threat-exposure read its programme shape (scoping, discovery, prioritisation, validation, mobilisation); Engage gives the validation and mobilisation stages their adversary-engagement strategy underneath. Programmes pair the two with CTEM as the programme discipline and Engage as the per-engagement strategy.

MITRE Engage and threat-led penetration testing under TIBER-EU and CBEST

TIBER-EU and CBEST are the assurance frameworks for threat-led penetration testing of financial entities, with named threat intelligence providers, named red teaming providers, and named blue team observation. MITRE Engage gives the blue-team side a structured operating frame for the long-running adversary-engagement posture that TIBER-EU and CBEST test against. The threat-led penetration test is the named-adversary exercise the Engage operating posture is validated against.

Running an Engage programme on SecPortal

SecPortal is the operating record for an adversary-engagement programme, not a replacement for the MITRE Engage matrix or the deception platform. The platform holds the in-scope threat model, the in-scope Engage activity set, the in-scope ATT&CK technique scope, the in-scope D3FEND defensive technique pairing, the Direct-stage operating posture inventory, the engagement-time interaction record, and the report that ties them together. Coverage tracking, the cross-engagement comparison, and the next-cycle activity roadmap live alongside the same findings management record that drives CVSS scoring and remediation. For multi-framework programmes, the same finding can carry an Engage activity tag, an ATT&CK technique tag, a D3FEND tag, and a mapping to NIST CSF 2.0, NIST SP 800-53, ISO 27001, SOC 2, PCI DSS, or CIS Controls without re-keying anything.

Findings management stores each adversary-interaction-driven finding with a free-text adversary-action mapping field that accepts MITRE ATT&CK technique identifiers, MITRE Engage activity references, and MITRE D3FEND defensive technique identifiers alongside CVSS 3.1, CWE, and OWASP categorisation, so the per-finding strategy-and-technique pair is held on the same record the engagement report and the audit pack read against.
Engagement management captures an Engage operation as a structured record: the named threat model, the named adversary profile, the legal authority, the scope, the operating environment, the Direct-stage provisioning inventory, the engagement window, the on-call route, the pause condition, the success criteria, and the named owner, so the engagement record is anchored to one workspace rather than to scattered slide decks and email attachments.
AI-assisted reports compose the engagement narrative from the live engagement, findings, and per-finding adversary-action tags, citing the named MITRE Engage activity, the named MITRE ATT&CK technique observed during the activity, the named D3FEND defensive technique that detected or prevented the adversary action, and the named operating tool where each interaction was observed, so the engagement report draws on the workspace record without re-keying the matrix into a document.
Compliance tracking lets one Engage engagement feed framework mappings to NIST CSF 2.0 (Identify, Protect, Detect, Respond, Recover, Govern functions), NIST SP 800-53 Rev 5 SI-3 and SI-4 (System monitoring), CA-7 (Continuous monitoring), and IR-4 (Incident handling), ISO 27001 Annex A 5.7 (Threat intelligence), A 5.24 (Information security incident management planning and preparation), A 8.16 (Monitoring activities), A 8.20 and 8.21 (Networks security), SOC 2 Trust Services Criteria CC7.1, CC7.2, and CC7.3 (Detection and incident response), PCI DSS Requirement 10 (Log and monitor) and 12.10 (Incident response plan), CIS Controls v8.1 Control 13 (Network monitoring and defence) and Control 17 (Incident response management), DORA Article 9 (ICT security policies), Article 10 (Detection), Article 11 (Response and recovery), and Article 17 (Incident response), and NIS2 Article 21 paragraph 2 (incident handling) and Article 23 (Reporting obligations), so the same engagement record reads several audit reads at once.
Document management holds the externally produced artefacts the platform does not generate inline: the threat model document, the named threat actor profile, the Engage charter, the legal authority memorandum, the Direct-stage provisioning inventory, the decoy-environment topology map, the lure inventory, the analyst routines, the on-call route, the pause-condition statement, the engagement-time decision log, the post-engagement debrief, and the next-cycle activity plan, with version history per artefact and named custodian per file, so the operating record points at durable storage rather than scattered file shares.
Activity log with CSV export records the actor, the entity, the action, and the timestamp for every state change on the engagement, the findings, the override decisions, and the retests, with 30, 90, and 365-day retention windows depending on plan, so the audit trail behind the Engage operating record is portable across audit cycles and personnel transitions.
External scanning runs the 16-module external surface check against verified domains so the perimeter-side observability that the Engage Detect-stage activities read against is anchored to the verified surface, with the per-finding output landing on the same engagement record the adversary-interaction record lands on.
Authenticated scanning runs the 17-module authenticated check behind verified credentials, with encrypted credential storage AES-256-GCM scoped to a verified domain and a named permission, so the post-authentication observability that the Engage Detect-stage activities read against is anchored to verified surface state.
Code scanning runs Semgrep SAST and dependency analysis against connected GitHub, GitLab, and Bitbucket repositories through OAuth so the application-layer observability that the Engage Prevent-stage activities read against is anchored to verified source state rather than a frozen export.
Bulk finding import accepts CSV intake from EDR, NDR, IAM, SIEM, deception platforms, honeypot platforms, canary token services, and threat intelligence platforms so externally produced Engage-relevant signals land on the engagement record alongside the SecPortal-produced findings, with column mapping for the activity reference, the adversary action, the affected asset, and the artefact touched.
Retesting workflows pair each remediated finding to a verification step run against the post-fix operating state, with the retest evidence carrying the same Engage activity reference and the same adversary-action tag the original finding cited, so the closure record updates the engagement record directly without renegotiation.
Finding overrides hold deferred Engage findings on the engagement record with a named approver, named scope, cited reason, hard expiry, and compensating control, so a deferred adversary-action observation is evidenced rather than silent.
Team management with role-based access keeps detection engineering, threat intelligence, incident response, security architecture, security engineering, SOC operations, AppSec, vulnerability management, GRC, and the security partner running the engagement on the same workspace with appropriate scoping per activity.
Multi-factor authentication enforcement at workspace level for the Engage operating record, so the identity assurance applies at access time as well as at evidence time, with AAL2 session promotion on every login.
Continuous monitoring schedules (daily, weekly, biweekly, monthly) keep the Detect-stage observability cadence on the same engagement record as the per-engagement interaction log, so the operating-posture read is continuous rather than per-week.

Honest scope: what SecPortal does not do

Engage work runs across multiple specialist tools, identities, and legal authorities the SecPortal product does not replicate inline. The honest scope below names the boundaries so the engagement record reads against the verified product surface and the externally produced artefacts attach through document management rather than implying the platform performs work it does not perform.

SecPortal is not a deception platform, a honeypot platform, a canary token service, an EDR, an NDR, a SIEM, a SOAR, an XDR, an MDR, an MTD, a CASB, an SSE, a SASE, or a DLP product. The deception infrastructure (decoy systems, decoy objects, decoy users, lure files, lure credentials, lure mailboxes, lure cloud roles, canary tokens) is provisioned and operated on the customer-managed deception platform (Thinkst Canary, TrapX, CounterCraft, Tracebit, Acalvio, Smokescreen, Illusive Networks, Smokescreen, Cymmetria, Attivo Networks, Tanium, Microsoft Defender for Identity decoys, Canarytokens, OpenCanary, T-Pot, Cowrie, Conpot, Dionaea, Glastopf, and others) and lands on SecPortal as bulk-finding import CSV intake or as engagement record evidence attached through document management.
SecPortal does not run live adversary emulation, live red-team operations, or live deception orchestration. The platform does not execute CALDERA plays, Atomic Red Team techniques, Mitre Caldera operations, Cobalt Strike beacons, or open-source command-and-control frameworks against customer infrastructure. The execution record from those tools lands on the engagement as evidence through bulk-finding import or document-management attachment; the operating tool runs where the customer runs it.
SecPortal does not push back to the deception platform or to the operating defensive tools. The platform does not write canary tokens, decoy user accounts, decoy cloud roles, SIEM rules, EDR detections, IAM policies, firewall rules, or network segmentation configurations into customer-managed operating tools. The provisioning work happens in the operating tool the team already runs; SecPortal carries the engagement record and the finding record that drives the work, not the configuration that ends up in the tool.
SecPortal does not provide legal authority, legal advice, or law-enforcement coordination for adversary-engagement work. Operating an adversary-engagement programme requires named legal authority, named escalation paths, and named handling for evidence that may be law-enforcement-relevant. The legal authority memorandum, the engagement-time decision log, the law-enforcement referral record, and the regulator-notification record live on the engagement as document-management artefacts; the legal counsel work happens with the customer-engaged legal team.
SecPortal does not ship packaged connectors into Jira, ServiceNow, Slack, Microsoft Teams, PagerDuty, SIEM platforms, SOAR platforms, GRC platforms, or CMDB systems. The Engage operating record and the per-finding ATT&CK/D3FEND/Engage pairings live on the SecPortal workspace and the wider operational ticketing, runbook, and asset-management workflows remain in the systems where the rest of the work is tracked.
SecPortal does not ship enterprise single sign-on, SCIM, or SAML at the platform layer. Workspace authentication is email-plus-password with TOTP multi-factor authentication enforcement; identity assurance for federated enterprise login remains on customer-managed identity providers.
SecPortal does not run automated approval routing for deferred Engage findings or for engagement-time pause-condition decisions. Risk acceptance, exception approval, deferred-finding sign-off, and engagement-time pause decisions are recorded on the workspace with named approver, named scope, cited reason, hard expiry, and compensating control through the finding-override feature; the platform records the decision rather than routing it through an external approval workflow engine.
SecPortal does not maintain the MITRE Engage matrix. The matrix is maintained by MITRE; SecPortal is the operating layer that runs an engagement against a versioned snapshot of the matrix, with the per-activity record paired to the workspace findings and evidence.
SecPortal does not issue Engage-aligned adversary-engagement verification certificates. Coverage claims at the engagement level are made by the engagement team and reviewed by the buyer; SecPortal supplies the operating record the claim is anchored in, not the certificate.
SecPortal does not replace the operating SOC, the detection engineering team, the threat intelligence function, the incident response retainer, the deception platform team, the MDR service, or the MSSP relationship. The platform is the operating ledger the work is recorded on; the work is performed by the customer team and the named partners the customer engages.

The operational workstreams the Engage programme reads against already exist as named use cases on SecPortal. The red team workflow carries the offensive technique evidence the Engage Detect and Affect stages read against. The purple team operations workflow captures the per-action outcome on the same engagement record at exercise time. The threat-led penetration testing workflow runs the named-adversary exercise the Engage operating posture is validated against. The continuous threat exposure management cycle runs the programme-level exposure-management discipline the Engage operating posture reads through. The emerging vulnerability and CVE watch program feeds the new-technique signals into the Engage refresh cycle. The security leadership reporting workflow reads the engagement record to the audit committee and board risk committee.

Key control areas

SecPortal helps you track and manage compliance across these domains.

Expose goal: surface adversary activity early enough to act on it

Carries the detection and observation surface the defence reads against the adversary. Detection content inventory, threat hunting routines, and decoy-driven observation activities sit here. Evidence: the per-engagement record of analyst-validated adversary interactions, the named ATT&CK techniques observed, the named D3FEND Detect-tactic techniques that fired, and the analyst response per interaction.

Affect goal: shape adversary decisions by changing the operating environment

Carries the operating-posture changes that slow the operator down, force a tooling change, or burn operator time on unproductive paths. Decoy systems, lure objects, constrained operating environments, and reaction-shaping operations sit here. Evidence: the named operating-environment change, the adversary action observed against it, the time-on-target measurement, and the named D3FEND Isolate-tactic technique pairing.

Elicit goal: draw out adversary tradecraft, motivation, and intent

Carries the long-running engagement posture that converts adversary activity into durable threat intelligence. Sustained decoy interaction, controlled disclosure, and instrumented response sit here. Evidence: the named adversary action against the engagement posture, the tradecraft observation, the named threat-intelligence enrichment to the actor profile, and the next-cycle threat-model refresh derived from the engagement.

Prepare activity class: charter the engagement against a named threat model

Carries the engagement charter that every Affect, Elicit, and Direct activity reads against. The legal authority, the engagement scope, the named operating owner, the on-call route, the pause condition, and the success criteria sit here. Evidence: the engagement charter artefact, the named threat actor profile, the named scenario, the named operating environment, and the signed legal authority memorandum.

Collect activity class: gather the operating baseline

Carries the operating baseline the rest of the engagement reads against. The threat-intelligence picture for the named adversary, the detection content inventory, the asset and identity context, the legitimate-user behaviour baseline, and the prior-engagement record sit here. Evidence: the operating baseline artefact, the named detection content inventory snapshot, the named asset inventory snapshot, and the named identity catalogue snapshot.

Detect activity class: see adversary activity in operating data

Carries the continuous observation surface against the named adversary. The agreed telemetry surface, the analytics catalogue, the threat-hunting routine, and the SOC operating routine sit here. Evidence: the per-engagement detection signal record, the named analytic that fired per signal, the analyst response per signal, and the named D3FEND Detect-tactic technique pairing.

Prevent activity class: harden against the named adversary

Carries the precondition surface the offensive technique relies on. The patch baseline, the configuration baseline, the identity hardening surface, and the network segmentation policy sit here. Evidence: the named precondition the named offensive technique relies on, the named hardening control that addresses it, and the named D3FEND Harden-tactic technique pairing.

Direct activity class: shape adversary decisions through environmental change

Carries the visible operating layer of the engagement. Decoy systems, decoy objects, decoy credentials, lure files, lure mailboxes, lure cloud roles, and constrained operating environments sit here. Evidence: the Direct-stage provisioning inventory, the operating-environment topology map, the lure inventory, the engagement-time interaction record per asset, and the named D3FEND Deceive-tactic technique pairing.

Related features

Vulnerability management software that tracks every finding

Orchestrate every security engagement from start to finish

AI-powered reports in seconds, not days

Compliance tracking without a full GRC platform

Every action recorded across the workspace

Document management for every security engagement

Find vulnerabilities before they ship

Vulnerability scanning tools that map your attack surface

Test web apps behind the login

Encrypted credential storage for authenticated scans

Repository connections for SAST and SCA

Bulk finding import bring your scanner data with you

Verify fixes and track reopens on the same finding record

Finding overrides that survive every scan cycle

Multi-factor authentication on every workspace

Collaborate across your entire team

Monitor continuously catch regressions early

Notifications and alerts for the people who carry the work

Run an adversary engagement programme on one workspace

Anchor each adversary interaction to a named MITRE Engage activity, the named ATT&CK technique observed, the named D3FEND defensive technique pairing, and the named threat model the engagement reads against. Carry the same engagement record across NIST CSF 2.0, NIST SP 800-53 Rev 5 (including SC-26 Decoys), ISO 27001 Annex A 5.7 and 5.24, SOC 2 CC7, PCI DSS Requirement 10, 11.5, and 12.10, CIS Controls v8.1 Control 13 and 17, DORA Article 9, 10, 11, 13, and 17, and NIS2 Article 21 and 23 without rebuilding the evidence pack per audit. Start free.