Pyramid of Pain

Some detections barely slow an attacker down. Others force them to relearn their job. The Pyramid of Pain is the model that tells you which is which: it ranks threat indicators by how much denying them costs the attacker.

David J. Bianco published it in 2013, and thirteen years of tooling changes have not dislodged it. The pyramid still shapes how security teams decide what to detect first.

Below: the six levels, with Bianco's own words for each. Why the top of the pyramid is where detection pays. And the part most write-ups skip - what it actually costs to operate there.

What is the Pyramid of Pain?

The Pyramid of Pain is a cybersecurity model created by David J. Bianco in 2013 that ranks six types of threat indicators by how much it costs attackers when defenders deny them - from trivially replaced hash values at the bottom to behaviors (TTPs), which force adversaries to relearn how they operate.

Bianco's own framing is sharper than any paraphrase. The diagram, he wrote, "shows the relationship between the types of indicators you might use to detect an adversary's activities and how much pain it will cause them when you are able to deny those indicators to them." The unit of measurement is not detection coverage. It is what denial costs the other side.

That focus is what separates the model from a generic list of indicator types. SANS catalogs it as "a conceptual model for the effective use of Cyber Threat Intelligence in threat detection operations, with a particular emphasis on increasing the adversaries' cost of operations." It is a prioritization tool for threat intelligence and detection work - not a maturity model, and not a ranking of which indicators of compromise are easiest to collect. Cheap indicators are easy to collect. That is exactly the problem.

The six levels make the ranking concrete - though one of them is the level most write-ups get wrong.

Explain It Like I'm 10

Imagine trying to stop a gang of pickpockets. Confiscate one thief's gloves, and they pull on another pair. Close one street, and they walk one block over. Neither slows the stealing. But if every guard in the city learns the gang's actual move - the bump, the apology, the lifted wallet - that trick stops working everywhere. The thieves would have to invent a new one, and inventing new tricks is slow, expensive work. The pyramid ranks everything you can take away from an attacker by how long it takes them to replace it.

Who created the Pyramid of Pain - and why?

The model was born from a recognizable frustration. On February 18, 2013, Mandiant released its APT1 report, profiling a Chinese state-linked intrusion group. In Bianco's words, the report "put a major hole in the APT intelligence dam" - suddenly, defenders everywhere held a rich set of real adversary indicators.

Then he watched what the industry did with them. His verdict: "almost no one is using them effectively." Teams loaded the hashes and IP addresses into blocklists, the adversary rotated them, and the value evaporated. Eleven days after the APT1 report, Bianco published the Pyramid of Pain on his Enterprise Detection and Response blog to explain what everyone was missing: indicators are not equal, and the ones easiest to feed into a tool are the ones attackers replace without noticing.

Here is a detail almost every retelling gets wrong: the version he first drew had only five levels. Hash values were not on the original 2013 pyramid at all. They arrived in a January 2014 revision, which Bianco flagged in a one-line update note:

> "I'm updating this post to include a slightly revised version of the Pyramid. The only real change I made was that I added a new level for hashes."

The most famous bottom layer of the model was, quite literally, an afterthought.

Bianco is not a historical footnote either. He is a Staff Security Strategist on Splunk's SURGe research team and a SANS certified instructor, with two decades in incident detection, threat hunting, and cyber threat intelligence; he also created the Threat Hunting Maturity Model. The model's original home, meanwhile, is still that same Blogspot post: the definitive source on the Pyramid of Pain remains a free blog page.

The six levels of the Pyramid of Pain

The pyramid runs from indicators that are trivial for an attacker to change, at the bottom, to ones that are genuinely hard to change, at the top. The labels on Bianco's diagram track that climb.

The disposable bottom: hashes and IP addresses

Hash values sit at the bottom because a file's fingerprint is the most fragile fact about it. Flip a single unused bit and you get, in Bianco's words, a completely different and unrelated hash value. He goes further than most vendors quoting him ever do: hashes change so easily, and there are so many of them, "that in many cases it may not even be worth tracking them."

IP addresses are barely stickier. Deny one and the adversary can "usually recover without even breaking stride" - and an operator behind Tor or a rotating proxy pool "may change IPs quite frequently and never even notice or care."

Domain names: a speed bump, not a wall

Domain names cost slightly more, because a working domain "must be registered, paid for (even if with stolen funds) and hosted somewhere." Bianco is honest about the ceiling here: with plenty of lax and free DNS providers available, "in practice it's not too hard to change domains." The bottom three levels share one economy - denial is nearly free to absorb.

Network and host artifacts: one level, not two

You will sometimes see the pyramid drawn with seven levels, splitting network artifacts and host artifacts into separate tiers. The original has six levels, with the two artifact types sharing one band. Network artifacts are "observables caused by adversary activities on your network" - think distinctive URI patterns or HTTP User-Agent values. Host artifacts are the same idea on the endpoint: registry keys, malicious service names.

The pain economics justify the shared band. This is the first level where denial forces real work: detect here and "you cause the attacker to go back to their lab and reconfigure and/or recompile their tools." Rotation stops being free.

Tools: taking away the quiver

One level up, detection targets the attacker's software itself, through antivirus signatures, Yara rules, or a tool's distinctive network protocol. Bianco's image is exact: "we are taking away the adversary's ability to use one or more specific arrows in their quiver." Replacing a burned tool means research to find an equivalent, development if none exists, and training to become proficient again - three separate costs, paid in time.

Above tools sits the level the whole model exists to elevate.

Why do TTPs hurt attackers the most?

TTPs - tactics, techniques, and procedures - are not things an attacker has. They are what an attacker does: how they escalate privileges, how they move laterally, how they trick a user into approving access. That distinction carries the whole model, and Bianco stated it plainly:

> "When you detect and respond at this level, you are operating directly on adversary behaviors, not against their tools."

Tools can be swapped. Infrastructure can be rotated. Behavior is the one asset an adversary cannot replace from a catalog, which is why the apex earns its label. Respond to TTPs quickly enough and "you force them to do the most time-consuming thing possible: learn new behaviors."

This is also where the pyramid connects to the framework most defenders use daily. MITRE ATT&CK is "a globally-accessible knowledge base of adversary tactics and techniques based on real-world observations" - in effect, the industry's catalog of the pyramid's top level, with every technique named and numbered.

A live example: the behavior that stays

The Scattered Spider intrusion group rotates hashes, addresses, and domains freely, yet one behavior recurs across its campaigns: CISA's joint advisory documents that the group sends repeated MFA notification prompts "to lead employees to accept the prompt and gain access to the target network" - technique T1621 in ATT&CK terms. Block the group's infrastructure and it shrugs. Detect the push-bombing (MFA fatigue) behavior itself, and every campaign that depends on it gets harder.

How defenders use the pyramid - and what it costs

The model earns its keep in three everyday jobs.

• Triaging threat intelligence: grade incoming indicators by level before spending effort on them. A feed of hashes is cheap to consume and cheap for the adversary to invalidate; a well-described technique is the opposite on both counts.
• Prioritizing detection engineering: aim new analytics at behaviors rather than static indicators, accepting more design effort per detection in exchange for detections that survive infrastructure rotation.
• Tracking threat hunting: Bianco's own PEAK framework lists hunts tracked by ATT&CK, Kill Chain, or Pyramid of Pain level as a core hunting metric - the pyramid as a scoreboard for where your hunting effort actually lands.

Now the honest part. Behavioral detection is the hardest kind to build well. A naive TTP analytic is often trivial to evade - which is precisely why MITRE's Center for Threat-Informed Defense built Summiting the Pyramid, "a methodology to score analytics against the pyramid of pain, helping defenders create more robust detections against adversary behavior." The project's bar for a detection worth keeping:

> "A robust analytic will remain accurate, even as adversaries implement new and sneakier versions of ATT&CK techniques."

The current release, Summiting the Pyramid v4.0.0, scores every analytic on five robustness levels - from Level 1, "Ephemeral Values," up to Level 5, "Core to Sub-Technique or Technique" - plus Telemetry Confidence scores for the log sources underneath. The version number matters when you read about this: many write-ups still describe v2 or v3.

There are prerequisites, too. Push Security's threat-research team names two for technique-level detection: a visibility vantage point that can actually observe the behavior, and the research velocity to keep detections current. Neither is free.

The cheap layers still earn their keep

The bottom of the pyramid never becomes worthless. A hash match is high-precision when it fires. An IP or domain block is instant and costs nothing to apply. The pyramid ranks pain, not value - climb deliberately, and keep the cheap layers doing the cheap work.

Is the Pyramid of Pain still relevant in 2026?

More than it was in 2013 - because the bottom layers now decay faster. Push Security's 2026 analysis argues that AI has not created a new problem so much as "compressed the timelines on an existing one - attackers can generate infrastructure, iterate on tooling, and industrialize newly discovered techniques faster than before," to the point that "the bottom layers of the Pyramid are collapsing under the weight of machine-speed operations." That is a vendor's framing, but the direction of the claim is hard to dispute: when indicator lifetimes shrink, a model that says indicators were always the weak investment looks better, not worse.

MITRE's continued investment says the same thing from the defender's side - Summiting the Pyramid reached its fourth major release in December 2024, with AttackIQ, Fortinet, IBM, Lloyds, and Microsoft among the participants. The pyramid is still the frame the industry builds on rather than a diagram it moved past.

The model asks one concrete thing of you this week:

• If you work in a SOC: tag your existing detections or hunts by pyramid level and look at the distribution - the creator of the model tracks hunting programs exactly this way.
• If you are studying: carry the six levels, with network and host artifacts as one of them, back to your coursework - you will know the model better than most of the pages citing it.

Either way, the point of the pyramid has not changed since the week the APT1 indicators burned out: detection effort is a budget, and it should be spent where denial hurts the adversary most.