MITRE ATLAS AI Audit Evidence: The Telemetry That Proves a Technique Fired

MITRE ATLAS reached 16 tactics, 84 techniques, 56 sub-techniques, 32 mitigations, and 42 documented case studies at version 5.1.0 in November 2025, and the February 2026 update pushed further into autonomous agents with techniques covering context and memory poisoning, agent configuration tampering, and exfiltration through tool invocation. The matrix is built on the ATT&CK model, so it carries the same implicit promise: a technique in the matrix is a thing you can look for.

Looking for it requires telemetry, and this is where AI security work tends to stall. A red team maps its findings to ATLAS technique names, hands over a report, and the receiving team discovers that reproducing or refuting any of it after the fact means reading application logs that were never designed to answer the question. I want to walk the artifacts that actually answer "did this technique fire, and when," for the tactics that reach an enterprise over HTTP AI traffic.

Reconnaissance and ML model access

The early tactics cover an adversary learning what model sits behind an endpoint and getting a channel to it. Against a hosted model consumed through your application, that channel is your inference path, and probing it looks like ordinary traffic with unusual shape: a burst of prompts from one principal that walk model behaviour rather than doing work.

The artifact that answers this is a per-request record carrying the caller identity, the destination endpoint and model version, and a timestamp with enough precision to correlate. Volume anomalies mean nothing without the identity column, because a spike attributed to a shared service account tells you a service was busy and nothing about who was driving it.

Execution and defense evasion at the prompt layer

Prompt injection and jailbreak techniques sit here, in both direct and indirect forms, and they are the ATLAS entries most enterprises are actually exposed to. Indirect injection is the harder one to evidence, because the hostile instruction arrives inside retrieved content rather than from the user.

The artifact is the assembled context window as transmitted, stored alongside the decision made about it. Storing the user's typed message and discarding the retrieved fragments produces a record that shows a benign request and hides the payload. I set out the mechanics in indirect prompt injection defense, and the evidence requirement follows directly: whatever the model saw is what the log has to hold.

Collection and exfiltration through the inference API

ATLAS treats the inference API as an exfiltration channel in its own right, and the agent-focused February 2026 additions extend that to exfiltration through tool invocation. For an enterprise, the exposure runs in the direction the framework spends less time on: regulated data leaving through a prompt, rather than model internals leaving through a response.

Evidence here is a per-request classification of prompt content evaluated before transmission, joined to the destination that received it. That pairing is what converts "someone may have pasted customer records into a model" into a list of principals, timestamps, and endpoints. Document-level labels inherited from a source system answer a different question, which is why prompt-level DLP produces this artifact and a data catalogue does not.

Persistence in agent memory

The 2026 agent techniques introduce a problem the matrix did not previously have: an adversary who writes to memory once and gets execution repeatedly. Reconstructing that means finding the write, which happened in a request that looked unremarkable at the time, and then finding every later request that read it.

The artifact is a retained request log covering a window long enough to contain the write. Most AI logging retains days. The write that matters is regularly weeks old, which makes retention a security property rather than a compliance formality. AI audit log retention requirements covers the periods the various regimes expect and where they fall short of the forensic need.

Impact and cost harvesting

Denial of service against an ML system and cost harvesting both show as traffic. The evidence is a destination and volume record per principal, which is the same artifact from the reconnaissance row read a different way. Grouping by identity rather than by service is again the property that makes it usable.

The tactics no request log will help with

Being honest about coverage is what makes an ATLAS mapping credible. Several tactics sit outside anything an HTTP request path can see. Training data poisoning against a model you build, physical or filesystem access to model artifacts, ML supply chain compromise through a poisoned package or a tampered pretrained model, and model theft through direct access to weights are all real ATLAS entries and none of them touch your inference traffic. Evidence for those comes from build pipelines, artifact registries, and host telemetry.

My candid view: the gap between ATLAS's research framing and enterprise reality is wider than the framework's popularity suggests. A large share of the matrix describes attacks on models you train, while the enterprises adopting ATLAS overwhelmingly consume hosted models and are exposed through the request path. Mapping all 84 techniques with equal weight produces a spreadsheet that flatters coverage. Mapping the dozen that reach your traffic, and evidencing those properly, produces something a post-incident review can use.

What the evidence set looks like

Five of the six rows come from one store. The sixth comes from somewhere else entirely, and saying so is part of the mapping.

DeepInspect

This is the evidence layer an ATLAS-mapped investigation reaches for on the traffic side. DeepInspect sits inline between your users or agents and the LLM APIs they call. Every request is evaluated for identity, prompt classification, and destination, policy is enforced per role and per route with a fail-closed default, and a signed, tamper-evident record is written before the response returns to the application.

That record holds the principal, the transmitted context window, the classification found in it, the model endpoint and version, the policy revision that governed the decision, and the outcome. When a red team report names a technique and asks whether it fired in production, the answer comes from a query rather than a reconstruction. The ATLAS controls mapping lines each in-boundary tactic up against the enforcement point that addresses it. Book a technical deep dive at deepinspect.ai.