BLAST RADIUS is built on four external frameworks, all of which permit redistribution and adaptation. This file records what is used, under which terms, and what each licence requires of us.
BLAST RADIUS is not affiliated with, sponsored by, or endorsed by The MITRE Corporation, MITRE Engenuity, NIST, or the National Cyber Security Centre.
| Source | Licence | Adaptation permitted | Used for |
|---|---|---|---|
| MITRE ATT&CK® v19.1 | MITRE terms of use, royalty-free | Yes, with copyright designation | Technique cards |
| MITRE ATLAS™ | Public release, distribution unlimited | Yes | ATLAS expansion |
| NIST SP 800-53 Rev 5 | US Government work, public domain | Yes, unrestricted | Control cards |
| CTID 800-53 → ATT&CK mappings | Apache License 2.0 | Yes, with notice | The detection mechanic |
| NCSC CAF v4.0 | Open Government Licence v3.0 | Yes, with attribution | Debrief scoring |
Everything the project ships is redistributable. There are no carve-outs, no verbatim-only constraints, and no files that must be kept out of the repository for licensing reasons.
Technique identifiers, names and descriptions on technique cards come from MITRE ATT&CK Enterprise v19.1.
© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.
ATT&CK® and MITRE ATT&CK® are registered trademarks of The MITRE Corporation. Per MITRE's branding requirements the first written reference is "MITRE ATT&CK®" and subsequent references are "ATT&CK" — capitalised, unhyphenated, unabbreviated. The mark does not appear in this project's name, logo or domain.
https://attack.mitre.org/resources/legal-and-branding/terms-of-use/
Technique content in the ATLAS expansion comes from MITRE ATLAS.
© 2026 The MITRE Corporation. Approved for public release; distribution unlimited.
Control identifiers, names and text on control cards derive from NIST Special Publication 800-53 Revision 5.
NIST SP 800-53 Rev. 5 is a work of the U.S. Government and is in the public domain under 17 U.S.C. §105.
No licence restrictions apply. Card text is written to fit the card rather than reproduced verbatim, and the control identifier on every card lets players trace it back to the source.
https://csrc.nist.gov/projects/risk-management/sp800-53-controls
The control-to-technique relationship that drives detection in this game comes from the MITRE Engenuity Center for Threat-Informed Defense.
NIST 800-53 to ATT&CK mappings © MITRE Engenuity Center for Threat-Informed Defense. Licensed under the Apache License, Version 2.0. http://www.apache.org/licenses/LICENSE-2.0
Apache 2.0 permits redistribution and derivative works provided the licence and notice are retained, which they are in every generated data file.
https://ctid.mitre.org/projects/nist-800-53-control-mappings/
The debrief scoring sheet uses CAF objective, principle and contributing outcome identifiers and titles.
Contains public sector information licensed under the Open Government Licence v3.0. © Crown copyright. https://www.nationalarchives.gov.uk/doc/open-government-licence/version/3/
OGL v3.0 permits copying, adapting and commercial exploitation with attribution. The evidence prompts and scoring guidance attached to each principle are original to this project.
https://www.ncsc.gov.uk/collection/caf
The project was originally built on the SCF, and the first card set shipped 108 SCF controls reproduced verbatim. That build has been withdrawn.
The SCF is published under CC BY-ND 4.0. Reproducing control text verbatim is permitted — §2(a)(1)(A) allows Sharing the Licensed Material "in whole or in part" — and the original build did that correctly, with byte-identical text enforced on every run.
The problem was the mapping, not the text. The game's central mechanic needs a control-to-technique relationship, and the SCF's ATT&CK mapping column supplied it. Shipping the card set meant shipping 4,872 of the SCF's 5,039 mapping edges — 96.7% of the entire mapping. Set Theory Relationship Mapping is the SCF Council's core work product and the thing its commercial licence exists to protect. An audit against control descriptions alone (108 of 1,534 = 7%) gave a falsely reassuring picture and missed this entirely.
CC BY-ND §4(b) provides that a database incorporating "all or a substantial portion" of the licensed material is Adapted Material, and §3(a)(2) forbids Sharing Adapted Material. The shipped card data was exactly such a database.
Rather than argue the point, the control layer moved to NIST 800-53 Rev 5 with CTID's Apache-2.0 mappings, which do the same job under terms that permit redistribution outright.
Three things improved as a side effect:
No SCF content remains in this repository.
CTID publishes mappings against ATT&CK 16.1; the technique cards are built from
ATT&CK v19.1. data/build/extract.py reconciles the two and reports how many
mapping edges point at techniques retired or restructured since 16.1. Retired
edges are excluded from play and the count is printed on every build, so drift
between releases is visible rather than silent.
The following are original to this project and licensed under LICENSE.md:
sources/ is git-ignored. Download the frameworks from their publishers — see
the README for the current list and the expected filenames.
This file sets out a considered reading of five licences. It is not legal advice and was not written by a lawyer. The current position is materially simpler than the SCF-based one it replaced, since every source now permits redistribution, but a solicitor's review before public launch remains sensible.
← Back to overview