You operate Bluebird Health SaaS’s CareOps Copilot, a retrieval-augmented generation application that reads approved clinical and Microsoft 365 content before answering staff questions. A red-team exercise finds a malicious instruction embedded in a retrieved document. The assistant follows that instruction and attempts to send connector data beyond the intended task. The incident crosses two boundaries: the application’s AI behavior and the enterprise permissions that made the data reachable. By the end of this course, you will produce a defensible red-team and detection-coverage plan for this kind of system.
MITRE ATLAS is a knowledge base for adversary behavior against AI-enabled systems. MITRE ATT&CK is a knowledge base for adversary behavior against enterprise systems. ATLAS tactics describe an attacker’s objective at each stage. Its published tactics are Reconnaissance, Resource Development, Initial Access, AI Model Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, AI Attack Adaptation, Command and Control, Exfiltration, and Impact. This course covers all of them as needed to trace AI incidents from entry to consequence. We can now locate the AI boundary and the enterprise boundary in one incident:
A technique is the documented method an adversary uses to reach a tactical objective. A case study connects techniques to a reported or demonstrated scenario. A published mapping is MITRE’s documented relationship between a case study, tactic, and technique. It gives the team a common reference point, rather than treating a locally coined label as threat intelligence.
Use ATLAS when the adversary targets or abuses an AI component. Use ATT&CK when the same incident includes established enterprise behavior, such as identity abuse, cloud discovery, or data movement. One incident can require both views. The goal is not to force every action into one matrix. The goal is to preserve the attack path and identify where telemetry, permissions, and controls should interrupt it. Use this recordkeeping rule to distinguish a documented mapping from a local hypothesis: