FROM SCAN REPORT TO HARDENED NETWORK: A MITRE ATT&CK-DRIVEN FRAMEWORK FOR CLOSING THE ATTACK SURFACE REDUCTION GAP

Samuel Bemi

doi:10.5281/zenodo.23330804

Abstract

Penetration testing is widely practised, yet its findings are rarely converted into durable architectural change.
Results are typically ranked by Common Vulnerability Scoring System (CVSS) severity, delivered as static
reports and actioned selectively, leaving structural weaknesses such as flat network segmentation and perimetercentric monitoring largely unresolved between engagements. This study proposes Map, Prioritise, Harden,
Validate (MPHV), a four-stage, tools-based framework that maps Nmap, Burp Suite and Metasploit findings onto
MITRE ATT&CK techniques and Cyber Kill Chain stages; prioritises remediation using a two-axis Exploit Path
Criticality matrix that weighs demonstrated exploitability against lateral blast radius; translates prioritised findings
into specific segmentation, firewall and IDS/IPS changes; and closes the loop by re-testing the exact technique
each control was intended to stop. The framework was developed through a qualitative, design-oriented
methodology that combined a structured review of academic literature and 2025 industry breach data with
practitioner experience from enterprise and healthcare engagements, and it is demonstrated through a tool-totechnique mapping, two composite cases and one publicly reported 2025 incident. The analysis indicates that the
gap between broad ATT&CK adoption and its shallow operational use is a plausible contributor to the long breach
lifecycles and lateral-movement-heavy breach patterns now reported by industry. The paper closes with an explicit
account of limitations: ATT&CK coverage is not predictive of novel techniques, prioritisation scoring remains
vulnerable to organisational pressure, and continuous validation is not yet affordable for many resourceconstrained organisations

Keywords

MITRE ATT&CK, Cyber Kill Chain, Network Hardening, Attack Surface Reduction, Penetration Testing, Network Segmentation

References

1) Ahmed, M., Panda, S., Xenakis, C., & Panaousis, E. (2022). MITRE ATT&CK-driven cyber risk
assessment. In Proceedings of the 17th International Conference on Availability, Reliability and Security
(ARES '22). ACM. https://doi.org/10.1145/3538969.3544420
2) Al-Sada, B., Sadighian, A., & Oligeri, G. (2025). MITRE ATT&CK: State of the art and way forward.
ACM Computing Surveys, 57(1), Article 12. https://doi.org/10.1145/3687300
3) Alshamrani, A., Myneni, S., Chowdhary, A., & Huang, D. (2019). A survey on advanced persistent
threats: Techniques, solutions, challenges, and research opportunities. IEEE Communications Surveys &
Tutorials, 21(2), 1851–1877. https://doi.org/10.1109/COMST.2019.2891891
4) Argaw, S. T., Troncoso-Pastoriza, J. R., Lacey, D., Florin, M.-V., Calcavecchia, F., Anderson, D.,
Burleson, W., Vogel, J.-M., O'Leary, C., Eshaya-Chauvin, B., & Flahault, A. (2020). Cybersecurity of
hospitals: Discussing the challenges and working towards mitigating the risks. BMC Medical Informatics
and Decision Making, 20, Article 146. https://doi.org/10.1186/s12911-020-01161-7
5) Basra, J., & Kaushik, T. (2020). MITRE ATT&CK as a framework for cloud threat investigation. Center
for Long-Term Cybersecurity, UC Berkeley. https://cltc.berkeley.edu/publication/mitre-attck/
6) CSO Online. (2022). The changing role of the MITRE ATT&CK framework. https://www.csoonline.com/
7) Cyber Monitoring Centre. (2025, June 20). Cyber Monitoring Centre statement on ransomware incidents
in the retail sector – June 2025. https://cybermonitoringcentre.com/2025/06/20/cyber-monitoringcentre-statement-on-ransomware-incidents-in-the-retail-sector-june-2025/
8) FIRST. (2023). Common Vulnerability Scoring System version 4.0: Specification document. Forum of
Incident Response and Security Teams. https://www.first.org/cvss/v4.0/specification-document
9) Georgiadou, A., Mouzakitis, S., & Askounis, D. (2021). Assessing MITRE ATT&CK risk using a cybersecurity culture framework. Sensors, 21(9), 3267. https://doi.org/10.3390/s21093267
10) He, Y., Huang, D., Chen, L., Ni, Y., & Ma, X. (2022). A survey on zero trust architecture: Challenges
and future trends. Wireless Communications and Mobile Computing, 2022, Article 6476274.
https://doi.org/10.1155/2022/6476274
11) Hutchins, E. M., Cloppert, M. J., & Amin, R. M. (2011). Intelligence-driven computer network defense
informed by analysis of adversary campaigns and intrusion kill chains. Leading Issues in Information
Warfare & Security Research, 1(1), 80–106.
12) IBM. (2025). Cost of a data breach report 2025. IBM Security and Ponemon Institute.
https://www.ibm.com/reports/data-breach
13) ISC2. (2024). ISC2 cybersecurity workforce study 2024. https://www.isc2.org/research
14) ISO/IEC. (2022). ISO/IEC 27001:2022 Information security, cybersecurity and privacy protection –
Information security management systems – Requirements. International Organization for
Standardization.
15) Jacobs, J., Romanosky, S., Edwards, B., Adjerid, I., & Roytman, M. (2021). Exploit prediction scoring
system (EPSS). Digital Threats: Research and Practice, 2(3), Article 20.
https://doi.org/10.1145/3436242
16) Joint Task Force. (2018). Risk management framework for information systems and organizations: A
system life cycle approach for security and privacy (NIST Special Publication 800-37, Rev. 2). National
Institute of Standards and Technology. https://doi.org/10.6028/NIST.SP.800-37r2
17) Lakshmanan, R. (2025, June 21). Scattered Spider behind cyberattacks on M&S and Co-op, causing up
to $592M in damages. The Hacker News. https://thehackernews.com/2025/06/scattered-spider-behindcyberattacks-on.html
18) MITRE. (2026). MITRE announces formation of the ATT&CK Advisory Council.
https://www.mitre.org/news-insights
19) MITRE Corporation. (n.d.). MITRE ATT&CK knowledge base. Retrieved September 2026, from
https://attack.mitre.org/
20) NIST. (2024). The NIST cybersecurity framework (CSF) 2.0 (NIST CSWP 29). National Institute of
Standards and Technology. https://doi.org/10.6028/NIST.CSWP.29
21) Pols, P. (2017). The unified kill chain [Master's thesis, Cyber Security Academy].
https://www.unifiedkillchain.com/
22) Rahman, M. R., Mahdavi-Hezaveh, R., & Williams, L. (2023). What are the attackers doing now?
Automating cyberthreat intelligence extraction from text on pace with the changing threat landscape: A
survey. ACM Computing Surveys, 55(12), Article 241. https://doi.org/10.1145/3571726
23) Rose, S., Borchert, O., Mitchell, S., & Connelly, S. (2020). Zero trust architecture (NIST Special
Publication 800-207). National Institute of Standards and Technology.
https://doi.org/10.6028/NIST.SP.800-207
24) Roy, S., Panaousis, E., Noakes, C., Laszka, A., Panda, S., & Loukas, G. (2023). SoK: The MITRE
ATT&CK framework in research and practice (arXiv:2304.07411). arXiv.
https://doi.org/10.48550/arXiv.2304.07411
25) Scarfone, K., Souppaya, M., Cody, A., & Orebaugh, A. (2008). Technical guide to information security
testing and assessment (NIST Special Publication 800-115). National Institute of Standards and
Technology. https://doi.org/10.6028/NIST.SP.800-115
26) Spring, J., Hatleback, E., Householder, A., Manion, A., & Shick, D. (2021). Time to change the CVSS?
IEEE Security & Privacy, 19(2), 74–78. https://doi.org/10.1109/MSEC.2020.3044475
27) Strom, B. E., Applebaum, A., Miller, D. P., Nickels, K. C., Pennington, A. G., & Thomas, C. B. (2018).
MITRE ATT&CK: Design and philosophy (Technical Report MP180360). The MITRE Corporation.
28) Syed, N. F., Shah, S. W., Shaghaghi, A., Anwar, A., Baig, Z., & Doss, R. (2022). Zero trust architecture
(ZTA): A comprehensive survey. IEEE Access, 10, 57143–57179.
https://doi.org/10.1109/ACCESS.2022.3174679
29) Verizon. (2025). 2025 data breach investigations report. Verizon Business.
https://www.verizon.com/business/resources/reports/dbir/
30) Xiong, W., Legrand, E., Åberg, O., & Lagerström, R. (2022). Cyber security threat modeling based on
the MITRE Enterprise ATT&CK Matrix. Software and Systems Modeling, 21, 157–177.
https://doi.org/10.1007/s10270-021-00898-7