MITRE EMB3D Threat Model for Embedded Devices
MITRE has introduced EMB3D, a new threat modeling framework for embedded devices. It aims to improve the security of devices in critical infrastructure, the Internet of Things (IoT), the automotive industry, healthcare, and many other areas. In April 2025, MITRE released version 2.0 of EMB3D with new threats, device properties, and mitigations.
Contents
How EMB3D compares with ATT&CK
Like the ATT&CK framework (Adversarial Tactics, Techniques, and Common Knowledge), EMB3D provides a central knowledge base of threats, but with a specific focus on embedded devices. ATT&CK covers cyber threats in general. EMB3D addresses the specific threats and vulnerabilities that occur in embedded devices.
The EMB3D framework at a glance
The EMB3D framework has three main components: device properties, threats, and mitigations.
- Device properties describe the hardware and software components of a device, including physical hardware, network services and protocols, and firmware. By mapping these properties, users can identify the threats associated with them.
- Threats describe how attackers can achieve certain objectives or effects on a system or device. Each threat includes information on the targeted technical properties, the actions the attacker must take, and the weaknesses that make the threat possible.
- Mitigations are strategies and techniques that help device manufacturers prevent or reduce threats. They define mechanisms or technologies intended to protect against the threat.
EMB3D in threat and risk analysis
The Cyber Resilience Act requires manufacturers to assess the cybersecurity risks of their products, and IEC 62443-4-1 requires a threat model as part of the secure development process. EMB3D does not replace either analysis, but it provides input for both. If you map the device properties of your product, you get a list of possible threats. You can then review them in the threat model, rate them by likelihood and impact, and assign suitable mitigations. Our article How TARA, Threat Models, and Cybersecurity Risk Assessments Differ explains how the threat model, the risk assessment, and the TARA relate to each other.
Our assessment
EMB3D is an important tool for manufacturers of embedded systems. It is a valuable resource for improving device security because it provides a central knowledge base of known threats and corresponding mitigations. We hope manufacturers adopt the framework widely, and we look forward to future updates with further mitigations. The framework is an important step toward more secure and more resilient software.
