SSG coverage claim · MITRE ATLAS-mapped
Browse AI-system risk by MITRE ATLAS
Browse the MITRE ATLAS v2026.08 tactic & technique taxonomy for AI systems, alongside SSG's own derived coverage tier for each technique — see the methodology note below for exactly what that tier does and does not claim.
Adversaries may prompt the AI service to retrieve data from a RAG database. This can include the majority of an organization's internal documents.
Tactics
Collection
ATT&CK cross-reference
No Enterprise ATT&CK cross-reference.
ATLAS mitigations & SSG coverage
AML.M0024
AI Telemetry Logging
Partial
Detective control: records every governed call; does not block it
AML.M0026
Privileged AI Agent Permissions Configuration
Enforced
Priority- and severity-scoped rules constrain privileged agent actions
AML.M0027
Single-User AI Agent Permissions Configuration
Partial
Per-project rule profiles; not a full multi-tenant identity system
AML.M0032
Segmentation of AI Agent Components
Partial
Rules fence paths and hosts; not process or network isolation
Methodology. Catalog: MITRE ATLAS v2026.08 (atlas.mitre.org).
Coverage tiers are derived from MITRE's own published mitigation↔technique mappings — never hand-assigned per technique.
SSG's claim is limited to which ATLAS mitigations it implements as controls; it does not claim to cover ATLAS techniques directly.
A tier records which SSG control exists for a MITRE-published mitigation — it is not a statement about outcome, and it is not a certification, an audit result, or an endorsement by MITRE.