Cyber Kill Chain
The Cyber Kill Chain is a model, developed by Lockheed Martin, that describes the stages of a cyber attack from initial reconnaissance through to achieving the attacker’s objective. Its seven stages help defenders understand and disrupt attacks: the earlier in the chain a defender can break it, the less damage the attacker can do.
The Cyber Kill Chain is a framework that breaks a cyber attack down into a sequence of stages, giving defenders a shared model for understanding how intrusions unfold and where they can be stopped. Developed by Lockheed Martin and adapted from a military concept, it frames an attack as a chain of dependent steps: disrupt any link, and the attack fails to reach its goal.
The classic model has seven stages. Reconnaissance is the attacker researching the target. Weaponisation is preparing the malicious payload. Delivery is getting that payload to the target, for example by email or a compromised website. Exploitation is triggering the vulnerability or trick that gains a foothold. Installation establishes persistence. Command and control opens a channel for the attacker to direct the compromised system. Actions on objectives is the final stage where the attacker achieves their goal, whether that is data theft, encryption for ransom, or destruction.
The framework’s central insight is that defence gets cheaper and less damaging the earlier in the chain it succeeds. Blocking a phishing email at the delivery stage prevents an entire intrusion; detecting an attacker only at the actions-on-objectives stage means the damage is already being done. This encourages defenders to build detection and prevention across every stage rather than relying on a single line of defence, an idea closely tied to defence in depth.
The Cyber Kill Chain is valuable as a communication and planning tool. It gives technical and non-technical stakeholders a common vocabulary for discussing where controls exist and where gaps remain, and it helps security teams map their detection coverage against the full lifecycle of an attack rather than focusing only on the stages they happen to monitor well.
The model has limitations. Its linear, perimeter-focused structure fits traditional malware-delivery attacks better than modern intrusions that begin with stolen credentials or that unfold largely inside an environment. For that reason many teams now use it alongside, or in place of, the MITRE ATT&CK framework, which catalogues the specific techniques attackers use at each stage in far greater detail and does not assume a strictly linear progression.
In practice, many teams use the kill chain alongside MITRE ATT&CK rather than choosing between them. The kill chain offers a simple, linear narrative that communicates well to non-technical stakeholders, while ATT&CK provides the granular, non-linear detail that detection engineers need. Used together, they let an organisation both explain its defensive strategy at a high level and measure its detection coverage technique by technique.
Precursor maps offensive engagements and detection coverage to attack-lifecycle models like the kill chain and MITRE ATT&CK, so organisations can see which stages they can disrupt today and where to strengthen detection next.