BUYER NOTE · PUBLISHED 29 SEPTEMBER 2026
MITRE ATT&CK in AI SOC platforms: how vendors map hunts and detections in 2026
Cyber AI Comparison team · Last checked September 2026 · Editorial assessment
Published 29 September 2026
StandardsDetection
What to know
MITRE ATT&CK has become the common language for what AI SOC agents hunt for and detect. In July 2026 Dropzone AI made generally available a threat hunter with 270+ ATT&CK-mapped hunt packs, and Prophet Security launched an agent that builds an ATT&CK coverage map from a team's own detections; Mate Security and Splunk also cite ATT&CK. A mapping shows intended scope, not effectiveness, so test it on your data.
Why does ATT&CK matter to AI SOC buyers?
MITRE describes ATT&CK as "a globally-accessible knowledge base of adversary tactics and techniques based on real-world observations". For a SOC it answers two questions: which attacker techniques would our detections notice, and which would pass unseen? As AI SOC platforms move from triaging alerts into hunting and detection engineering, ATT&CK is how they describe that work, and how buyers can compare it.
How do vendors in this guide use ATT&CK?
| Platform | What the vendor describes | When |
|---|---|---|
| Dropzone AI | AI Threat Hunter runs hypothesis-driven hunts from 270+ prebuilt hunt packs mapped to ATT&CK, across Splunk, Microsoft Sentinel, CrowdStrike NG-SIEM, Elastic and Panther | Generally available 29 Jul 2026 |
| Prophet Security | AI Detection Engineer builds an ATT&CK coverage map from a team's own detections and investigations, then writes, tunes and backtests rules for SIEMs including Splunk, Sumo Logic and Microsoft Sentinel | Launched 30 Jul 2026 |
| Mate Security | Threat hunting from plain language or CTI reports, mapped to ATT&CK | Platform page, reviewed Sep 2026 |
| Splunk SOAR | Prebuilt playbooks aligned to ATT&CK and D3FEND | Product page, reviewed Sep 2026 |
What is a coverage map, and why build it from your own data?
A coverage map marks which ATT&CK techniques your current detections would catch. Built by hand, it is usually a spreadsheet that goes stale. Prophet Security's launch describes building the map from a team's own detections and investigations and then working on the gaps. Whatever tool builds it, a map built from your own rules and alert history is more useful than a generic coverage claim, because it reflects what your environment actually logs.
What are hunt packs?
A hunt pack is a prepared hunt: a hypothesis about attacker behaviour, the queries to test it, and the ATT&CK techniques it relates to. Dropzone AI's packs run across several SIEMs, which matters for teams whose data sits in more than one. Ask how packs are updated, whether you can write your own, and how results are recorded: a hunt that finds nothing is still evidence, if it is logged.
What does a mapping not tell you?
- Whether the data a technique needs is actually collected in your environment.
- How often a detection mapped to a technique fires on benign activity.
- Whether a backtested rule would have caught the attacks you have actually seen.
- How the agent reached its verdict on a hunt result; that is an explainability question, covered in our lesson on reading verdicts.
What should you ask vendors about ATT&CK?
- Which techniques do your hunts and detections cover for our main data sources, and can we export the mapping?
- Is the mapping built from our data or from your library?
- How are new techniques added when ATT&CK is updated?
- Are hunting and detection engineering agents priced separately from triage?
Where does NIST fit?
ATT&CK describes attacker behaviour; NIST's Cybersecurity Framework 2.0 describes the outcomes a security programme should reach. On 18 August 2026 NIST released the initial public draft of SP 1353, a quick-start guide with AI prompts and use cases for analysing and reporting on CSF 2.0 outcomes, with comments due on 15 October 2026. The two fit together: evidence of ATT&CK coverage supports the Detect outcomes a CSF report describes. Our lesson on ATT&CK, D3FEND and NIST covers each document.
Does ATT&CK coverage affect our scores?
Indirectly. We score investigation depth, where hunting and domain coverage count, rather than ATT&CK coverage itself, because no vendor publishes a comparable coverage figure. The highest investigation depth score in this edition is 9, held by Mate Security; see how we score.