How TTP-based Defenses Outperform Traditional IoC Hunting

Etay Maor argues that defenders should move from chasing Indicators of Compromise to detecting attacker behaviours, using a TTP-first approach aligned with MITRE ATT&CK to spot activity such as privilege escalation, credential theft, and lateral movement often before encryption or data exfiltration. The piece highlights the Pyramid of Pain, in which TTPs sit at the top as harder elements for adversaries to alter, making behaviour-based detection more effective than surface-level IoCs.

It notes that conventional IoC‑driven tools are reactive and easily changed, and that a fragmented tool sprawl across EDR, firewalls, SIEMs and VPNs creates visibility gaps and slow containment. The author references IBM’s 2025 Cost of a Breach Report to illustrate ransomware’s business impact, stating the average cost is around $5.08 million and that AI-assisted social engineering is involved in about 16% of breaches, with more than 20,000 new CVEs each year.

The article advocates a cloud-native SASE architecture delivering inline protection, unified telemetry mapped to ATT&CK behaviours, and coordinated operational controls including micro-segmentation and zero-trust access, to enable faster containment and recovery. According to IBM’s 2025 Cost of a Breach Report.