Free tools Windows power users keep installed
One-click scans. No signup required.
Oligo Security’s Application Attack Matrix is a community-driven framework intended to map attacks against applications, APIs, cloud-native systems, and software pipelines in more detail. Announced in July 2025, it is Oligo’s proposed application-focused companion to MITRE ATT&CK—not an official MITRE finding that ATT&CK is deficient, and not a framework MITRE has endorsed.
What is Oligo’s Application Attack Matrix?
Oligo describes the Application Attack Matrix as a way to map adversary tactics, techniques, and procedures aimed at modern applications. Its July 9, 2025 announcement presents it as community-driven and invites security practitioners to contribute. The proposed scope includes web applications, cloud-native architectures, microservices, APIs, and the software pipelines that build and deliver them. Oligo’s announcement was authored by Avi Lumelsky, Gal Elbaz, and Hadas Marzook.
Oligo’s premise is that an application attack can be difficult to describe if analysis focuses only on infrastructure, operating systems, or endpoint behavior. The matrix aims to make application context more explicit, including how dependencies are compromised, how runtime protections are bypassed, how APIs or authentication are misused, and how business logic is abused. These are Oligo’s claims about the value and intended scope of its framework, not proof that other security frameworks or controls fail to address those behaviors.
How does it compare with MITRE ATT&CK?
MITRE describes ATT&CK as a globally accessible knowledge base of adversary tactics and techniques, available for building threat models and defensive methodologies. It also provides guidance organized around areas including cloud, mobile, operating systems, and industrial control systems. MITRE’s ATT&CK overview does not discuss or endorse Oligo’s matrix.
#1 Best Overall
The useful distinction is therefore one of emphasis, not a formal replacement or a documented finding of failure. ATT&CK is a broad knowledge base for modeling adversary behavior; Oligo proposes more application-specific detail for attacks that involve code dependencies, APIs, runtime behavior, and application logic. CyberScoop reported the launch on July 8, 2025, and described Oligo’s matrix as complementing ATT&CK’s broader categories. CyberScoop’s coverage quotes Oligo co-founder and CTO Gal Elbaz: “Most of the approaches that we know today are focused on the post-exploit technique, and on the infrastructure and endpoint,”
That characterization should be read as Elbaz’s assessment of existing approaches, not as a statement by MITRE. CyberScoop also quotes Oligo AI security researcher Avi Lumelsky explaining the application-centered scope: “We are focusing on cloud applications, but we don’t care what is the cloud provider, whether it’s a container or not, whether it’s a regular machine or Kubernetes. To us, an application is an application.”
What application-layer behaviors does Oligo want to make visible?
The matrix’s stated focus is on behaviors that can be obscured by broad labels such as “exploitation” or by analysis limited to the host or network. Oligo and CyberScoop describe several areas of detail:
Rank #2
- Software supply chain: compromised code signing, poisoned third-party dependencies, and attacks through software build or delivery pipelines.
- Application entry points: authentication bypass, API misuse, credential-free login scenarios, and exploited vulnerabilities.
- Runtime behavior: remote code execution, injection, server-side request forgery, command-and-control over application protocols, and disabling runtime protection.
- Application relationships and logic: abuse of service-to-service trust, remote-service exploitation, and manipulation or abuse of business logic.
CyberScoop reports that the matrix distinguishes among different causes and paths—such as an exploited vulnerability, a bypassed control, credential-free login, or supply-chain compromise—instead of treating them as interchangeable instances of exploitation. This is a proposed mapping approach; the sources do not establish that every technique is unique to Oligo’s matrix or absent from other taxonomies.
Recommended Free Tools
What are the matrix’s four phases?
Oligo groups its examples into four stages of an application attack lifecycle. The examples below are those in its July 2025 announcement; they illustrate the framework’s organization rather than a separate investigation of specific incidents.
1. Pre-intrusion
This phase covers preparation and reconnaissance. Examples include harvesting API specifications, mapping dependencies, and analyzing public source code. Resource development can include compromising code signing or poisoning a third-party dependency.
Rank #3
2. Intrusion
Intrusion covers initial access and execution. Oligo lists supply-chain compromise, authentication bypass, and API misuse as possible access paths, followed by execution techniques such as remote code execution, injection, or server-side request forgery.
3. Post-intrusion
After gaining a foothold, an attacker may seek privilege escalation, use application protocols for command-and-control, or disable runtime protection. The phase also includes expanding access through service-to-service trust abuse or remote-service exploitation.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →4. Impact
The final phase includes disruption, destruction, encryption, and exfiltration, as well as application-specific outcomes such as business-logic abuse or manipulation of application integrity.
Oligo says incidents and examples including Bybit, Log4Shell, SolarWinds, XZ Utils, MOVEit, and GitHub Actions supply-chain attacks informed the framework. That means Oligo associates them with the application-layer and supply-chain risks it wants to describe; it does not mean the matrix independently investigated or reclassified each incident.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How could security teams use the matrix?
Oligo proposes several uses for the framework. These are intended applications described by its publisher, not independently measured results.
- Threat modeling: trace applications, APIs, and software pipelines against the attack phases and behaviors.
- Security testing: design tests that examine more than initial access, including runtime, service relationships, and potential impact.
- Control validation: check whether existing controls address the behaviors the organization considers relevant.
- Detection and investigation: develop application-specific detections and use the mapped behaviors to structure compromise investigations.
- Risk and investment planning: assess organizational exposure and prioritize security investment.
- Purple-team exercises: build exercises around application attack paths and evaluate defensive responses.
For a team evaluating whether the matrix fits its program, useful comparison questions include how much application-specific detail it provides, how it treats supply-chain and runtime context, whether its lifecycle coverage matches the team’s needs, and how mapped techniques support threat models, detections, and control validation. The reviewed sources describe Oligo’s scope and intended uses but do not provide an independent comparative evaluation.
What is established—and what is not?
The available material establishes that Oligo announced an application-focused framework in July 2025, described four attack phases, and invited community contributions. It does not establish MITRE endorsement, independent adoption figures, measured effectiveness, or comparative coverage against ATT&CK. No named, independently attributable statistic in the reviewed sources demonstrates the matrix’s adoption, coverage, or effectiveness.
Oligo’s separate Workload Protection page describes its product as tying workload detections to application-layer exploits, but that is a vendor product claim, not evidence that the Application Attack Matrix itself improves security outcomes. Oligo’s Workload Protection page does not establish a measured result for the framework.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
