MITRE ATT&CK v18: What’s in it — and why it matters

MITRE released ATT&CK v18, introducing structured Detection Strategies and Analytics that map behaviors to specific telemetry, expanding coverage across cloud/DevOps, containers, mobile, and OT, and updating CTI with new threat groups, software, and campaigns tied to techniques. The release refines defense evasion into stealth vs. impair-defense tracks and emphasizes actionable operationalization—coverage mapping, analytics-as-code, and validation—so defenders can more effectively translate TTPs into detections.