Most of an AI Attack Is an Ordinary Attack

The common wisdom is that securing an AI system is a new discipline, demanding unfamiliar tools and controls. But the people who catalogue attacks for a living have already tested that idea, and their answer is mostly no.

MITRE publishes two matrices. ATT&CK has catalogued adversary behaviour against conventional systems for a decade. ATLAS does the same for AI systems. Because ATLAS was deliberately modelled on ATT&CK, you can lay one over the other and measure how much of the AI threat landscape is actually new.

We did. Roughly seven-eighths of it is not.

The shape of the two matrices

Thirteen of ATLAS's sixteen columns are ATT&CK's columns, by name: Reconnaissance, Resource Development, Initial Access, Execution, Persistence, Privilege Escalation, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration, Impact.

Those are not adapted or AI-flavoured. They are the same goals an attacker has always had. An adversary attacking your model still has to get in, stay in, move sideways, and take something out — and the ways they do that are the ways they have always done that.

Two columns are actually new

After accounting for one naming artefact we will come back to, exactly two ATLAS tactics have no equivalent in the classical matrix:

• AI Model Access (AML.TA0000) — obtaining a degree of access to the model itself, whether that is a public API, an inference endpoint, or the weights.
• AI Attack Staging (AML.TA0001) — the preparation that is specific to attacking a model: crafting adversarial inputs, building a proxy model, poisoning training data.

Look at the identifiers. TA0000 and TA0001 are the lowest numbers in the scheme, which means these two were defined first and the thirteen classical columns were imported around them afterwards. Instead of adding AI concerns to an existing security framework, the ATLAS authors started with two novel AI-specific ideas and surrounded them with the framework that was already there.

Those two new columns hold 21 techniques of 170 — 12.4% of the catalogue. The remaining 87.6% fall under tactics your existing security programme should already address.

What that means if you are the one responsible

This does not mean AI security is easy. It means the work splits unevenly, and the smaller part is the part that needs new thinking.

If your organisation has deployed a model and someone has asked you to secure it, the honest starting position is that most of your exposure is the exposure you already had. The endpoint serving the model is an endpoint. The credentials the inference service uses are credentials. The data you pipe into it moves over a network you already own the problem of. If access control, segmentation, logging and credential hygiene were weak before the model arrived, the model did not create that weakness — it added a valuable thing behind it.

This can be an unwelcome message. It is more comfortable to hear you need a new category of tool than to be told the real gap is in the fundamental controls you have not finished implementing. But it is also good news for sequencing: the 87.6% is work with mature tooling, known practice, and people who already know how to do it. Our guide on an afternoon spent on account security covers the unglamorous end of exactly this.

The 12.4% is where you need to learn something new — and because it is 12.4% rather than everything, learning it is tractable.

The two new columns, concretely

Model access is a privilege you are probably granting without modelling it. In classical terms, access to an inference endpoint looks like access to a read-only API — low risk, widely granted. In ATLAS terms it is the precondition for most of the rest of the matrix: it is what lets an attacker probe behaviour, measure responses, and build the understanding that staging requires. If you have exposed a model endpoint more broadly than you would expose the data it was trained on, that decision deserves revisiting.

Attack staging is reconnaissance you cannot see. A proxy model is built offline, from your model's public responses. Adversarial inputs are developed elsewhere and arrive as a single valid-looking request. There is no intrusion to detect in the staging phase, because the staging happens on the attacker's hardware using outputs you gave away for free. This is the novel part of the threat, and it is why rate limiting and output verbosity on a model endpoint are security controls, not just cost controls.

A wrinkle we nearly published as a finding

Comparing the two tactic lists by name reports three ATLAS-only tactics, not two. The third is Defense Evasion.

It is not an AI concept. ATT&CK split that tactic into Defense Impairment and Stealth — the Enterprise collection we measured was modified on 5 August 2026 — and ATLAS still carries the old name. A naive comparison reads that as an AI-specific tactic and reports the AI-specific share of techniques as 21.8% instead of 12.4%, nearly double the true figure.

We mention it because it is the kind of error that looks like a finding, and anyone re-running this comparison will hit it. It also shows that a derived framework lags the one it derives from. If your AI risk process cites ATLAS tactic names and your security process cites ATT&CK's, they are already using different words for the same column, and that divergence will widen rather than close.

What we measured, and what we did not

These figures come from the published STIX bundles for both matrices, pulled on 19 August 2026, with revoked and deprecated objects excluded — they remain in the files, and counting them inflates the two matrices by different amounts.

Two limits. Counting techniques treats them as equal units, which they are not: one technique may be far more consequential than another, and a count cannot see that. And ATLAS is a younger, smaller catalogue at 170 techniques to ATT&CK's 697. The 87.6% classical share partly reflects how much has been documented so far, not a settled truth about the threat landscape. If ATLAS grows mainly in its two AI-specific columns, that share will fall.

Worth re-measuring in a year. The script is in our repository.