Attribution-driven adaptive prioritization of tactics (ADAPT): linking threat identifiability to sector-specific control prioritization

Purpose The purpose of this paper is to develop a quantitative framework that translates cyber attribution uncertainty into defensive control priorities. Organizations lack systematic methods to convert sector-specific attribution probabilities into differentiated security investments. This study introduces a probability-weighted tactic-scoring function that converts estimated public attribution status into ranked defensive priorities for both known and unknown attackers, providing a defensible basis for resource allocation decisions. Design/methodology/approach This study analyzes 14,096 cyber incidents (2016–2023) using a two-stage framework. Stage 1 uses logistic models with sector-by-attack-class interactions to estimate attribution probabilities. Stage 2 integrates these with MITRE ATT&CK behavioral data using Bayesian-smoothed frequencies, generating separate priority scores for known and unknown attackers. Bootstrap validation and sensitivity analyses confirm robustness. Findings The framework reveals a fundamental divide in defensive priorities based on public attribution status. Defense Evasion (TA0005) is the universal top priority. The decision value lies in secondary priorities, which diverge as a function of attribution likelihood: Persistence (TA0003) dominates when attribution is unlikely (<40%), while Discovery (TA0007) dominates when attribution is likely (>70%). This pattern, whether reflecting adversary strategy or differential observability, provides actionable guidance for resource allocation. Patterns remain stable under parameter variation and resampling. Practical implications Organizations can map predicted attribution to control priorities. Low-attribution sectors benefit from emphasizing persistence detection; high attribution sectors benefit from discovery-focused controls. This study illustrates how tactic priorities translate to NIST SP 800–53 control families. Originality/value The probability-weighted scoring functional generalizes to any context with estimable class distributions, behavioral frequencies and uncertainty gates. This framework bridges attribution research and defensive strategy by quantitatively linking empirical attribution patterns to sector-specific control priorities, moving organizations beyond generic best practices toward attribution-aware security investment.