Attackers Don’t Execute Frameworks. They Execute Procedures

Cybersecurity has become exceptionally good at describing attacks. Threat intelligence identifies adversaries. MITRE ATT&CK standardizes behavior. The Continuous Threat Exposure Management (CTEM) framework includes how to prioritize exposures. Validation tests controls. But the industry has not become equally good at answering the question that matters most: “Can our defenses stop an attack?”

The blind spot is how the attack is actually executed.

Security programs organize threats around actors, techniques, vulnerabilities, and controls. But attackers operate through procedures: commands, tools, scripts, dependencies, and sequences used to accomplish an objective.

Knowing an adversary uses credential dumping does not reveal how credentials will be accessed, which commands will be used, or what evidence the activity will create. Two organizations may claim coverage for the same ATT&CK technique, but that is abstract and does not detect the procedure or the attacker execution.

Exposure management faces the same limitation. A critical vulnerability is not automatically a critical path to compromise. Its significance depends on whether existing defenses can interrupt the execution itself.

Security teams already have more recommendations than they can implement. Severity, maturity, and compliance help order the backlog, but they do not prove that an action will reduce attacker success. The more consequential question is: “Which defensive change will disrupt the greatest number of relevant adversary procedures?”

The next era will be defined by threat-led defense based on connecting threats, assets, vulnerabilities, detections, and defenses to the procedures attackers actually use.

Organizations that make this shift will know where attacks can be stopped and whether their defenses are prepared to stop them.

Attackers do not execute frameworks. They execute procedures. Defenders must measure their defenses at the same level.