MITRE INFORM v2.0

MITRE INFORM defines threat-informed defense and the discreet activities associated with its practice. The project captures insights and best practices for what it means to be threat-informed across a security program and expands the dimensions of threat-informed defense into components that organizations can implement. For each of these components, the project defines specific levels of implementation maturity, which enables organizations to assess and understand the current and future state of their threat-informed defense program.

The project is funded by our research participants.

• What is Threat-Informed Defense?
  • Overview
  • Leveraging ATT&CK
  • A Continuous Process
• Three Dimensions of Threat-Informed Defense
  • Threat-Informed Defense Cycle
  • Cyber Threat Intelligence
  • Defensive Measures
  • Test and Evaluation
  • Dimensions and their Components
• Measure Threat Informed Defense
  • Methodology
  • Weighting and Scoring
  • Overall Threat Informed Defense Scoring
  • Example Scoring
  • Threat Informed Defense Maturity Levels
• Maximize & Mature Threat Informed Defense
  • Recommendations
  • Improvement
  • Tracking Improvement over Time
• Moving Forward
• Conclusion
  • Acknowledgements
• Changelog
  • MITRE INFORM v1.0
  • Measuring, Maximizing, and Maturing Threat Informed Defense (M3TID) 1.0
• Appendix A - Online Assessment
  • Results page
• Appendix B - Scoring Spreadsheet and JSON
• Appendix C - CMM Mappings

Notice

© 2026 MITRE. Approved for public release. Document number(s) CT0105.

Licensed under the Apache License, Version 2.0 (the “License”); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an “AS IS” BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.

This project makes use of ATT&CK®: ATT&CK Terms of Use