Pyramid of Pain

Interactive Pyramid of Pain by David Bianco. Click each layer to explore attacker evasion cost, defensive ROI, detection methods, and real-world ATT&CK-mapped examples from hash values up to TTPs.

By Mohamed Habib Jaouadi•May 19, 2026•

Post Related

#cti

#threat-intelligence

#pyramid-of-pain

#detection-engineering

#mitre-att&ck

#blue-team

The Pyramid of Pain

Higher layers inflict more pain on the adversary. Click each layer to explore evasion costs, detection strategies, and ROI.

More pain for the attacker

Less pain for the attacker

Core Principle

Each level up multiplies attacker cost. Hashes rotate in seconds. TTPs take months to restructure. Programs that operate at the upper layers force adversaries into expensive changes that meaningfully reduce their operational tempo.