If you haven’t tested it, it doesn’t work. This is a foundational thesis that led to the creation of the Atomic Red Team project, and the concept of “atomic testing” for cybersecurity teams. As the project has been integrated into myriad tools and processes, one thing we’ve learned is that testing should be approached more like exercise than an exam. Even a small amount of regular testing pays far larger dividends than annual or “big bang” red team engagements.
One way to encourage ongoing testing is a framework for tracking, scoring, and measuring tests and test outcomes. For some time, I’ve maintained a crude spreadsheet that can be used to record and score atomic tests. In the spirit of making this a bit accessible, I took a crack at converting this venerable spreadsheet into a web-based tool.
What is it?
At its core, Atomic Scorecard is a simple system of record for atomic tests. Like Atomic Red Team, it uses MITRE ATT&CK as the foundation, but it overlays industry threat intelligence, and naturally makes it easy to find atomic tests relevant to each technique.
No account is needed. There’s no database or other backend. None of your test data is stored.
Intelligence-driven prioritization
The single most common hangup related to ATT&CK is that it’s expansive, and it’s not easy to figure out where to start. Relatively few organizations produce enough first-party threat intelligence to know which techniques are most important to defend against, and even then, this isn’t necessarily representative of the techniques that present the most risk. What we do know is that not all techniques are created equal—some are far more prevalent than others. From Red Canary’s 2026 Threat Detection Report:
[A] relatively small number of techniques play a role in a disproportionately large number of detections . . . [O]ver the last five years, we’ve detected at least one of the 10 most prevalent techniques in 46 percent of all detections. Over the same time period, we detected at least one of the top 20 techniques in 63 percent of detections.
By default, technique rankings are based on Red Canary’s annual Threat Detection Report, representing the most prevalent techniques observed across thousands of companies of every size and industry. Also included are Mandiant’s top techniques and subtechniques, as well as the complete M-Trends appendix, which provides the top techniques observed for each ATT&CK Tactic.
- Red Canary 2026 Threat Detection Report (default)
- Mandiant M-Trends 2026 Top Techniques
- Mandiant M-Trends 2026 Top Sub-Techniques
- Mandiant M-Trends 2026 Complete ATT&CK appendix (top techniques and sub-techniques for every ATT&CK tactic)
That said, there are lots of useful sources of threat intelligence, and every company, environment, and set of priorities is unique. So, you can easily upload your own custom rankings to reflect the specific threats your organization faces.
Integration of ATT&CK + Atomic Red Team
The tool is built to move you from documentation to execution in seconds:
- Every technique is linked directly to the official MITRE ATT&CK documentation
- For any technique where an Atomic Red Team test exists, a clickable logo appears that takes you directly to tests that correspond to that technique
I recommend using the Invoke-AtomicRedTeam framework, which makes test selection, execution, and optionally things like prerequisites and cleanup fast and easy.
Tracking and reporting
Testing is less impactful if you don’t record and measure the results. For every technique that you test, you can categorize test outcomes into one of four states:
- Missed: The attack went completely unnoticed.
- Observed: You saw the telemetry, but no alert was triggered.
- Detected: You were alerted to the activity.
- Mitigated: The attack was blocked or interdicted by existing controls.
You can also add notes related to a given technique, since a simple status may not capture important context, or mark a technique as not applicable to your environment.
A simple dashboard at the top makes it easy to see your test coverage and outcomes.
Flexibility and customization
To ensure this tool stays relevant as ATT&CK, Atomic Red Team, and your priorities evolve, the Maintainer tools allow you to update or customize:
- ATT&CK version
- Atomic Red Team coverage
- Technique ranking
There’s also a simple JSON-based backup and restore capability. Export your entire project as a JSON structure at any time. When you’re ready to resume, just import the file and pick up exactly where you left off.
Share your feedback
If there’s something you’d like to see that isn’t included, something isn’t working, or if you’d just like to send some feedback, you can reach me via email: kwm @ this domain.
Ready to start testing? Give it a go at https://atomicscorecard.com
]]>