The MITRE Corporation

MITRE occupies an odd seat in the American defense industrial base. It builds no weapons, bids on no production contracts, and competes with none of the companies whose work it reviews. What it runs instead are federally funded research and development centers, six of them, each chartered by a government sponsor to supply engineering judgement that no vendor has a commercial reason to bend. The organization was carved out of MIT Lincoln Laboratory in 1958 to see the Semi-Automatic Ground Environment air defense system through to fielding, and the arrangement stuck. Today it is a 501(c)(3) not-for-profit of roughly 8,000 staff, headquartered in both Bedford, Massachusetts and McLean, Virginia, turning over on the order of $2.4 billion a year.

Defense sits with the National Security Engineering Center, sponsored by the Department of Defense, where the work is architecture, acquisition analysis, test strategy and systems engineering for the services, the combatant commands and the intelligence community. Aviation has its own center. The Center for Advanced Aviation System Development advises the Federal Aviation Administration on the National Airspace System, modelling traffic flow, separation standards and the long slog of air traffic control modernisation. The Center for Enterprise Modernization works the federal back office for the Treasury and the Internal Revenue Service, co-sponsored by Veterans Affairs, the Social Security Administration and the Commerce Department, which in practice means tax systems, benefits delivery and the unglamorous plumbing of government IT. The Homeland Security Systems Engineering and Development Institute does the same for the Department of Homeland Security across border, transport and critical infrastructure problems. A health center sponsored by the Centers for Medicare and Medicaid Services covers payment systems and public health data. The sixth, the National Cybersecurity FFRDC, answers to the National Institute of Standards and Technology and operates the National Cybersecurity Center of Excellence.

The name most people know MITRE by came out of that cyber work, and it is given away. ATT&CK catalogues how real adversaries behave once they are inside a network, and it has become the shared vocabulary for red teams, product vendors and defenders who agree on very little else. MITRE also runs the CVE Program, the numbering scheme behind every publicly disclosed software vulnerability, alongside the Common Weakness Enumeration, the D3FEND countermeasure knowledge graph, the STIX threat information format and the Caldera adversary emulation platform, which was handed to the Apache Incubator in 2026 to widen its governance. MITRE Labs carries the internal research, spanning artificial intelligence, microelectronics, quantum sensing and cyber operations, and pushes results back into sponsor programs. Independence is the actual product here. Staff cannot hold stock in the companies they evaluate, and the FFRDC charters bar MITRE from chasing the production work its own analysis shapes, which is the reason sponsors keep paying for advice they could in theory buy from a contractor.