The AI Threat Landscape

Almost every documented AI security incident maps to one of these six categories. They are not exhaustive, but if you can defend against all six you have covered the vast majority of what attackers actually do against AI systems in the real world.

Reading about attack categories is useful. Reading about real incidents that happened to real organisations is more useful. Each of the incidents below reveals something specific about how AI security failures happen in practice.

The incidents above span a range of sophistication. Chevrolet was social engineering. Anthropic was state-level industrial espionage. What connects them is that both became possible because AI lowered the cost of attacks that previously required significant skill or resources.

Spear phishing used to require a human researcher per target. Model extraction at scale used to require significant cryptographic or ML expertise. Chatbot manipulation required understanding a specific system's quirks. Now LLMs make all of these accessible to a much wider population of attackers, and they make the sophisticated attacks faster for the ones who were already doing them.

The attack category tells you what was done. The threat actor profile tells you why, which determines how you defend. A nation-state running a long-term model extraction campaign requires very different detection and response compared to an opportunist who found a badly configured chatbot.

MITRE ATT&CK is the security industry's shared vocabulary for how attackers operate against traditional systems. It documents tactics (what the attacker is trying to achieve: initial access, lateral movement, exfiltration) and techniques (specific methods to achieve each tactic). Almost every SIEM, EDR, and threat intel platform maps to ATT&CK.

MITRE ATLAS is the same thing for AI and ML systems. ATLAS stands for Adversarial Threat Landscape for Artificial-Intelligence Systems. It uses the same tactic-technique structure as ATT&CK but adds the phases, actors, and techniques specific to attacking AI: targeting the training pipeline, attacking the model itself, using AI-generated content as a weapon, and exfiltrating through the inference API.

As of v5.1 (November 2025), ATLAS contains 16 tactics and 84 techniques. It is a living document maintained by MITRE with contributions from the security research community. The techniques are tagged to real-world case studies where possible.

If you already know ATT&CK, ATLAS will be immediately familiar in structure. The key additions are the ML-specific phases at the beginning (targeting training data, the model supply chain) and the AI-specific techniques at the end (prompt injection, model extraction, using AI to automate other attacks).

Each tactic represents a phase or objective in an adversary's operation against an AI system. The techniques within each tactic are the specific methods to achieve that objective. The diagram below lists all 16 in order of a typical attack lifecycle.

If your team already uses ATT&CK for threat modelling and SIEM mapping, here is the fastest way to understand ATLAS. The structure is the same. The content is different in five specific ways.

Training pipeline phases are new. ATT&CK starts at initial access to a running system. ATLAS starts earlier: at the point where an attacker might compromise the training data, the training infrastructure, or the model supply chain. These phases have no ATT&CK equivalent because traditional software does not have a training pipeline.

The model itself is an asset to attack. In ATT&CK, data is the target. In ATLAS, the model is also a target. Model extraction, model poisoning, and model inversion are techniques that target the model as an artifact, not just the data it processes.

Inference is a new exfiltration path. ATT&CK's exfiltration phase covers network channels and physical media. ATLAS adds exfiltration via AI inference: the model outputs data that was in its training set, or an attacker extracts model capabilities by querying the inference API.

AI as a weapon has its own tactic. The Weaponization tactic covers using AI offensively: generating phishing content, creating deepfakes, using AI to accelerate vulnerability research. This has no equivalent in ATT&CK because the tool being weaponised is the AI system itself.

ATLAS is smaller but growing. ATT&CK has hundreds of techniques across 14 tactics for Enterprise. ATLAS v5.1 has 84 techniques across 16 tactics. The ATLAS technique set is more focused because the attack surface it covers (AI and ML systems) is more specific than "all enterprise software."

ATLAS is most useful as an input to threat modelling and to structuring your adversarial testing programme. Here is the practical workflow.

Start with your system's data flow. Draw the path that data takes from ingestion through training (if applicable) through inference to output. For each step, ask which ATLAS tactic applies. If you have a RAG pipeline, the retrieval step is an AML.TA0003 surface (ML Model Access through the vector database) and a prompt injection surface (AML.TA0013 Model Evasion through indirect injection via retrieved documents).

Pick the three most likely tactics for your system. Not all 16 apply equally. A deployed LLM API without a publicly accessible training pipeline is primarily exposed to ML Model Access, Model Evasion (jailbreaks and injection), and Exfiltration via inference. A company that hosts its own model training is additionally exposed to ML Supply Chain Compromise and Model Poisoning.

Map ATLAS techniques to your test cases. For each tactic you identified, pick the two or three most commonly exploited techniques and make sure your adversarial testing covers them. DiscoveR's 11 test categories map directly to the ATLAS tactic set. Running a DiscoveR scan gives you coverage across the most common ATLAS techniques in about the same time it takes to read this module.

Use ATLAS to structure your incident reports. When an AI security incident occurs, tagging the ATLAS techniques used gives you a shared vocabulary with your threat intelligence team, with vendors, and with regulators. "The attacker used AML.T0054 (LLM Prompt Injection)" is more precise than "someone typed a weird prompt and the chatbot misbehaved."

The six attack categories from Section 02 each require a different defensive approach. The table below maps each category to the primary defensive control and where Mirror Security products are the most relevant tool.

You now have the full threat landscape map. Module 03 drills into the OWASP Top 10 for LLMs, the most-referenced prioritised risk list for teams building with LLMs. After completing Track 1, choose the path that matches what you are building.