Free tools Windows power users keep installed
One-click scans. No signup required.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Organisations can use the hacker’s playbook to find weaknesses before attackers exploit them: understand the behaviours adversaries use, test whether security controls prevent or detect those behaviours, and improve identity protection, patching, logging and incident response where tests reveal gaps.
What does a hacker’s playbook mean for defenders?
It means studying how attackers behave—not just collecting threat names or buying tools. MITRE ATT&CK organizes tactics and techniques observed in real-world activity. Defenders can use that structure to identify gaps, organize detections, hunt for threats and validate mitigations. CISA’s guidance explains why this matters: “The success network defenders have in detecting and mitigating cyberattacks depends on this understanding.” CISA’s MITRE ATT&CK mapping guidance describes ways to map defensive coverage to adversary techniques.
For an organisation, the practical question is: if an attacker tried a particular behaviour, would a control stop it, would monitoring reveal it, and would the right people know what to do next? The answer should be established through testing, not assumed from a product list or a policy document.
Why realistic testing can expose gaps in mature security
A CISA red-team assessment illustrates the difference between having security measures and knowing how they perform. The team achieved persistent access and moved laterally across multiple sites without detection. At the same time, MFA prompts prevented access to one sensitive business system. These are findings from a specific assessment—not a measure of how often organisations experience the same weaknesses. CISA’s red-team advisory documents the assessment and its lessons.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
The contrast is useful: one control helped protect a sensitive system, while the assessment also found that attacker activity elsewhere was not detected. A test should therefore examine both prevention and visibility. A control that blocks one route does not establish that other routes are covered, and a monitoring alert is not useful unless someone can investigate and respond.
How to turn attacker behaviours into a defensive test
- Select the behaviours to assess. Use relevant ATT&CK techniques to define what the exercise will emulate, rather than treating “attack simulation” as a single undifferentiated test.
- Map each behaviour to the controls and telemetry that should address it. Identify which technologies are expected to prevent the action, which should detect it, and which logs or alerts responders need.
- Test the controls against those behaviours. Use an authorised red-team or equivalent exercise with a defined scope and safety boundaries.
- Analyse what happened. Record whether activity was blocked, detected, missed or detected too late, and whether responders could investigate and act.
- Tune the response. CISA recommends using results to improve people, processes and technology—not merely to adjust a detection rule. Repeat testing after meaningful changes to controls or systems.
This process follows CISA’s red-team recommendations: select ATT&CK techniques, align relevant technologies, test them, assess prevention and detection performance, then tune the organisation’s response. ATT&CK is a way to organize and evaluate coverage, not a universal product ranking or a guarantee that every technique will be caught.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Which defensive priorities follow from the playbook?
Strengthen identity and access controls
Use multifactor authentication and sound identity and access management. MFA can help prevent access even when an attacker has obtained a password, as the CISA assessment’s blocked access to one sensitive system illustrates. That single example does not show that MFA alone is sufficient or that every MFA implementation will stop every route into an organisation.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteFor accounts where phishing-resistant authentication is appropriate, a FIDO2-compatible hardware security key is one possible implementation of MFA. Confirm that the organisation’s services support the key, and plan how users can regain access if a key is lost or unavailable. The joint CISA, FBI and NSA guidance recommends MFA but does not endorse a particular product or key brand. The joint advisory provides broader identity and mitigation guidance.
Patch exposed systems with urgency
Prioritise patching known exploited vulnerabilities, as recommended in joint CISA, FBI and NSA guidance. A patching process should make it possible to identify affected systems, assign owners and track remediation rather than relying on periodic reminders alone. Keep threat-specific priorities aligned with current advisories because adversary behaviour and relevant risks change.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Make logs useful—and protect them
Logging only helps when relevant activity is recorded, retained and available to investigators. CISA advises organisations to establish logging and monitoring procedures, protect logs from unauthorised access or deletion, retain them according to policy and compliance needs, and assign response roles. CISA’s logging guidance for small and medium businesses outlines these practices.
As part of an exercise, check whether logs needed to investigate the selected behaviours exist and whether responders can access them. If activity is missed because telemetry is absent, inaccessible or deleted, changing an alert rule will not solve the underlying problem.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Prepare the people and operational processes
Maintain incident-response and continuity plans, exercise them, and define how incidents are reported and who should be contacted. The joint CISA, FBI and NSA advisory also calls attention to gaps in IT and operational technology security coverage. For organisations operating both, include the relevant responsibilities and coordination in planning and exercises rather than assuming IT procedures automatically cover OT systems.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How should an organisation compare defensive options?
Compare options by how they address a specific adversary behaviour and by whether the organisation can prove they work in its environment. The source guidance supports testing and tuning controls; it does not establish a universal ranking of security products.
| Question | What to establish |
|---|---|
| Which behaviour does it address? | Identify the attacker action or technique the control is intended to prevent or reveal. |
| Does it prevent, detect or both? | Separate blocking capability from monitoring and alerting; do not treat one as proof of the other. |
| Can its effectiveness be tested? | Define an authorised test and the expected result before relying on the control. |
| What visibility and response coverage does it provide? | Check whether the necessary activity is logged, alerts reach the right people and responders can investigate. |
| What ongoing effort is required? | Account for the people and processes needed to configure, monitor, maintain and improve the control. |
What organisations should take away
The useful lesson from the hacker’s playbook is not to imitate attackers for its own sake. It is to use observed behaviours to ask concrete questions of defences: what would stop this action, what would reveal it, and could the organisation respond? Test those assumptions, protect the identity and system foundations attackers target, preserve investigation-quality logs, and exercise the people and plans responsible for recovery.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
