ThreatMatrix

ThreatMatrix: MITRE ATT&CK® Reference for Security Operations

NO SUBSCRIPTION. NO TRACKING. 100% OFFLINE.

Built for SOC analysts, incident responders, and threat hunters who need ATT&CK during an investigation — in an air-gapped environment, mid-incident, or anywhere without a connection.

Need T1078 right now? ThreatMatrix opens instantly to the complete framework, native on iPhone, iPad, and Mac.

COMPLETE MITRE ATT&CK v19.1 COVERAGE
• 900+ techniques with detection guidance and mitigations
• 175+ threat groups including APT29, Lazarus Group, and others
• 900+ software and malware families mapped to their TTPs
• 100+ mitigations with actionable defense recommendations
• Full sub-technique support (T1078.001)

FAST AND FULLY OFFLINE
• The complete ATT&CK database ships inside the app — open it and it's there
• No network requests, no analytics, no third-party SDKs
• Deep-link straight from your SIEM, terminal, or notes (threatmatrix://)
• Spotlight integration for system-wide search

SEARCH AND NAVIGATE
• Full-text search across techniques, groups, software, and mitigations
• Filter by tactic, platform, or matrix (Enterprise, Mobile, ICS)
• ATT&CK IDs auto-link in descriptions — tap T1234 to jump straight there
• Recently viewed history for fast pivoting during an investigation

YOUR RESEARCH, ORGANIZED
• Bookmark with folders and tags — tap any tag to see everything filed alongside it
• Add private notes to any technique, group, or software entry
• Syncs across your devices through your own iCloud, with no account to create
• Home screen widget with a new technique each day

PLATFORM SUPPORT
• Native iPhone and iPad app with an adaptive sidebar layout (iOS and iPadOS 18.6 or later)
• Native Mac app with a three-column layout, keyboard shortcuts, and trackpad/mouse hover support (macOS 15.6 or later, Apple Silicon)
• Universal purchase — buy once, use everywhere
• Full Dark Mode support

PRIVACY
No analytics, no tracking, no personal data collection, no advertising. Bookmarks and notes live in your private iCloud; everything else stays on your device.

DATA SOURCE
Based on MITRE ATT&CK® v19.1, bundled in the app for instant offline access and updated to track MITRE's releases.

MITRE ATT&CK® and ATT&CK® are registered trademarks of The MITRE Corporation. Reproduced and distributed with the permission of The MITRE Corporation. ThreatMatrix is an independent application and is not affiliated with, endorsed by, or sponsored by The MITRE Corporation.

ATT&CK does not enumerate all possible adversary behavior, and relying solely on documented techniques may leave defensive gaps. All materials are provided "as-is" without warranties.