MITRE ATT&CK Enterprise
T1591.003
enhancement

Identify Business Tempo

Parent: T1591

Description

Adversaries may gather information about the victim's business tempo that can be used during targeting. Information about an organization’s business tempo may include a variety of details, including operational hours/days of the week. This information may also reveal times/dates of purchases and shipments of the victim’s hardware and software resources. Adversaries may gather this information in various ways, such as direct elicitation via [Phishing for Information](https://attack.mitre.org/techniques/T1598). Information about business tempo may also be exposed to adversaries via online or other accessible data sets (ex: [Social Media](https://attack.mitre.org/techniques/T1593/001) or [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594)).(Citation: ThreatPost Broadvoice Leak) Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Establish Accounts](https://attack.mitre.org/techniques/T1585) or [Compromise Accounts](https://attack.mitre.org/techniques/T1586)), and/or initial access (ex: [Supply Chain Compromise](https://attack.mitre.org/techniques/T1195) or [Trusted Relationship](https://attack.mitre.org/techniques/T1199))

Mapped SPARTA techniques

2 techniques

  • REC-0002.03OperationsST0001
    addresses
    high

    Operations cadence, pass schedules, shift patterns, LEOP windows, maintenance intervals — these are 'business tempo' indicators; T1591.003 'Identify Business Tempo' is the ATT&CK sub-technique that addresses operational-tempo reconnaissance.

  • REC-0004Gather Launch InformationST0001
    addresses
    moderate

    Launch schedules, launch windows, and integration timelines are operational-tempo signals; T1591.003 'Identify Business Tempo' covers this dimension of launch reconnaissance, downgraded because T1591.002 (business relationships) is the dominant aspect of REC-0004.

Cite as SafeMode Space, mitre-attack-enterprise T1591.003.

Built 2026-07-25 from 216 techniques, 334 regulation articles, 125 ENISA controls, 2,610 framework controls, and 90 countermeasures.