How do you actually use MITRE ATT&CK in your day to day work?

Use ATT&CK as a shared language and a coverage map, not a checklist. Tag detections and incidents with technique IDs so you can see which tactics you can actually observe, then close the gaps that matter for your threat model. It also structures investigations: once you confirm one technique, the neighboring tactics tell you where to look next for initial access, credential theft or persistence.

Three ways. First, coverage: every detection we owned was tagged with technique IDs, so leadership could see we had solid coverage on execution and credential access and almost nothing on defense evasion. That gap became a quarter of detection work. Second, investigations: when I confirm one technique I use the matrix to decide where to look next. If I have confirmed scheduled task persistence, I go back for the initial access vector and any credential dumping between those two points. Third, purple team: we ran atomic tests for specific technique IDs and marked coverage honestly as detected, logged only, or blind. The thing I push back on is coverage percentages. We had a technique marked covered by a rule that only fired on the default tool name, which any competent attacker renames in about four seconds. So I grade coverage by whether the detection keys on behavior rather than a string, and I would rather report sixty percent honestly than ninety percent that nobody has tested.