Tier reflects the defender's structural position against a technique, independent of attacker effort. A simple Voice Channel Pivot is Tier 3 because no email-text-scanning paradigm can detect what happens after the call connects. A complex multi-stage redirect chain may be Tier 2 because it is, in principle, traceable with sufficient compute. The tier is a procurement question, not a difficulty rating.
Each technique gets one canonical name. Some are intent-named (Sandbox Detonation Gate, Authentication Alignment Evasion, Authority Impersonation): the safeguard bypassed is the diagnostic feature. Others are behavior-named (Voice Channel Pivot, QR Code Mobile Pivot, HTML Smuggling): the mechanic is distinctive enough to anchor analysis on its own. The rule is what a SOC analyst would type into a search bar first.
Each category is defined by the detection capability it primarily defeats, not by what the technique looks like superficially. Many techniques chain across categories in real campaigns; the taxonomy classifies the technique, not the campaign.
Each cell shows the canonical ID, name, naming axis (intent / behavior), tier badge, and source tag. OBS = dataset-validated against the Dec 2025 to Feb 2026 StrongestLayer corpus. LIT = literature-validated from public threat research. Use the search box or filter chips to narrow.
Each StrongestLayer technique maps to the closest MITRE ATT&CK technique or sub-technique, plus aliases used by other vendors and research teams. Use this matrix when reading a third-party advisory and trying to locate the corresponding technique in this taxonomy.
| ID | Canonical Name | MITRE ATT&CK | Common Aliases |
|---|
The taxonomy is a search index. Open this page, type a technique name or symptom into the search box, and the matching cell opens. Each detail panel includes the MITRE mapping and common combinations so you can pivot to threat-hunt rules, ATT&CK Navigator layers, or your own alert pipeline.
The categories and tiers are the conversation. "We have addressed Tier 1 across all categories and Tier 2 in three of five" is a substantive maturity statement. Use the matrix in vendor evaluations to ask which techniques does the architecture you are evaluating ever close, by design, not just what features does it ship.
The IDs (EV-CS-001, EV-DT-006, etc.) are stable references. Cite them in coverage claims and detection-rule documentation. Renaming a canonical name in a future revision will not break ID-based references. The cross-reference matrix is the bridge to MITRE and to other vendor taxonomies; submit corrections to the StrongestLayer threat research team.
It is not a complete enumeration of every email evasion ever observed. It is a working catalog at v1.0 of the techniques most relevant to enterprise defenders today, expected to evolve quarterly. It is not a scoring system; the ICE (Indicators of Coordinated Evasion) framework is the scoring layer that operates on top of this taxonomy. It is not a buying guide; tier and category answer architectural questions, not vendor questions.