- Tactics describe the high-level goals or objectives of an attacker (e.g., initial access).
- Techniques describe how the attacker achieves those goals (e.g., spear phishing).
- Procedures are specific implementations or detailed steps taken by attackers that reflect real-world scenarios.