# What is the Impact tactic in MITRE ATT&CK?

Impact is the attacker's end goal made visible: encrypting data for ransom, wiping systems, stopping services, corrupting backups, defacing websites, or manipulating data and industrial processes. In ATT&CK it also includes inhibiting recovery, such as deleting shadow copies and backup catalogues. By this stage containment is urgent and evidence is under pressure. Prevention lies earlier: offline backups the attacker cannot reach, separation between IT and production, and alerts on the steps that come before. Encryption itself happens on hosts; where it hits network shares, one client reads and rewrites large amounts of data in a short time. NetSenX has no dedicated detection for the encryption step and does not stop it; it watches the stages before, such as beaconing, scanning, lateral movement and unusual outbound volume, on every plan.

FAQ: [Attack techniques explained](https://netsenx.com/en/faq/attacks) · https://netsenx.com/en/faq/what-is-the-impact-tactic-in-mitre-attack

## Read next

- https://netsenx.com/en/detect-lateral-movement-c2-beaconing
- https://netsenx.com/en/is-someone-inside-your-network

## Related questions

- [What is the cyber kill chain, and how does it relate to MITRE ATT&CK?](https://netsenx.com/en/faq/what-is-the-cyber-kill-chain)
- [How can a small team use MITRE ATT&CK to find gaps in its detection?](https://netsenx.com/en/faq/how-to-use-mitre-attack-to-find-gaps-in-detection)
- [What happens after an attacker gets into the network?](https://netsenx.com/en/faq/what-happens-after-an-attacker-gets-in)
- [Can antivirus or EDR alone catch lateral movement?](https://netsenx.com/en/faq/can-antivirus-or-edr-alone-catch-lateral-movement)
- [Why is a flat network dangerous?](https://netsenx.com/en/faq/why-is-a-flat-network-dangerous)