The Cyber Kill Chain Explained: Why Every Cybersecurity Professional Needs to Know It
Serious intrusions are sequences, not single events. An attacker does not simply “break in” — they research a target, build something to send it, deliver it, get code running, establish a foothold, take control, and only then go after what they actually came for. The Cyber Kill Chain® is the model that made that sequence explicit, and it remains one of the first frameworks any cybersecurity professional is expected to be able to explain. This guide covers where the model came from, what each of its seven stages means, the single idea that made it matter to defenders, and — just as importantly — where it now shows its age.
Where the Cyber Kill Chain came from
The model was published in 2011 by three Lockheed Martin researchers — Eric M. Hutchins, Michael J. Cloppert and Rohan M. Amin — in a paper titled Intelligence-Driven Computer Network Defense Informed by Analysis of Adversary Campaigns and Intrusion Kill Chains. “Cyber Kill Chain” is a registered trademark of Lockheed Martin.
The term was borrowed from military targeting doctrine. The paper cites a United States Department of Defense chain of find, fix, track, target, engage, assess — commonly abbreviated F2T2EA — and describes it as “an integrated, end-to-end process described as a ‘chain’ because any one deficiency will interrupt the entire process.”
The authors’ argument was that conventional defence had the problem backwards. Antivirus and patching addressed the vulnerability component of risk, and incident response assumed a compromise had already succeeded. Against well-resourced adversaries running multi-year campaigns — what this paper did more than any other to popularise as the Advanced Persistent Threat — that was not enough. If you could break an intrusion into discrete phases, you could place controls against each one, and act during the attack rather than after it.
The seven stages of the Cyber Kill Chain
The paper defines the intrusion kill chain as reconnaissance, weaponization, delivery, exploitation, installation, command and control (C2), and actions on objectives. The descriptions below follow the original definitions, with a note on how each stage looks in practice today.
1. Reconnaissance. Research, identification and selection of targets. The 2011 paper describes “crawling Internet websites such as conference proceedings and mailing lists for email addresses, social relationships, or information on specific technologies.” Today the same activity runs through LinkedIn profiles, GitHub repositories, job adverts that name your exact security stack, DNS and certificate transparency records, and credentials harvested from previous breaches.
2. Weaponization. Coupling an exploit with a payload to produce something deliverable — in the paper’s framing, pairing a remote access trojan with an exploit, frequently wrapped inside a PDF or Office document. This stage happens entirely on the attacker’s own infrastructure, which is precisely why it is so hard to observe directly.
3. Delivery. Transmission of the weapon into the target environment. In Lockheed Martin’s own incident data for 2004–2010, the three dominant vectors were email attachments, websites and USB removable media. Email remains the workhorse; the notable additions since are malicious advertising, compromised software updates, and messaging and voice channels.
4. Exploitation. The attacker’s code is triggered. Usually this targets an application or operating system vulnerability, but the paper is explicit that exploitation “could also more simply exploit the users themselves” — a line worth remembering whenever someone frames security purely as a patching problem.
5. Installation. A backdoor or remote access trojan is placed on the victim system so that access survives a reboot, a closed session or a changed password. This is the point at which an incident stops being an event and becomes a presence.
6. Command and Control (C2). The compromised host beacons out to attacker-controlled infrastructure. Once that channel is open the intruder has, in the paper’s memorable phrase, “hands on the keyboard” inside the target environment. Modern C2 hides in exactly the traffic you cannot block: HTTPS, DNS, and legitimate cloud services.
7. Actions on Objectives. Only now, the paper stresses, can the intruder do what they came to do — collect and exfiltrate data, encrypt or destroy it, or use the compromised host as a stepping stone deeper into the network.
The one sentence that made the model matter
Strip away the diagrams and the model rests on a single claim from the paper:
“Kill chain analysis illustrates that the adversary must progress successfully through each stage of the chain before it can achieve its desired objective; just one mitigation disrupts the chain and the adversary.”
That is a genuinely optimistic proposition, and it reframes the defender’s job. The attacker has to succeed at every stage. You only have to succeed at one. A phishing email that lands but whose payload will not execute is a failed intrusion. A payload that executes but cannot reach its C2 server is a failed intrusion. Defence in depth stops being a slogan and becomes an arithmetic argument.
The paper pairs this with a courses of action matrix, borrowing six verbs from US information operations doctrine — detect, deny, disrupt, degrade, deceive, destroy — and asking defenders to fill in a grid: for every stage, which of our controls does each of these things? The paper’s own worked example is exploitation, where a host intrusion detection system passively detects the exploit, patching denies it outright, and data execution prevention disrupts it once it starts.
The real value is in the empty cells. Fill the grid in honestly for your own organisation and you will typically find five overlapping controls stacked on delivery, and almost nothing on reconnaissance or C2.
Why cybersecurity professionals need to know it
It gives you a shared language. “We caught it at delivery” and “we caught it at actions on objectives” describe two wildly different days at work, and everyone in the room understands the difference immediately. When an analyst, an incident responder and a CISO can place an event on the same chain, handovers stop losing information.
It turns detection into a strategy rather than a shopping list. Security tooling is easy to buy and hard to justify. Mapping what you own onto the chain converts “we have an EDR and a firewall” into “we have four ways to detect exploitation and no way at all to spot reconnaissance” — which is a budget conversation you can actually win.
It makes threat intelligence usable. An indicator on its own is trivia. An indicator placed at a stage tells you what to do with it: a sending domain belongs to delivery controls, a file hash to exploitation and installation, a beacon interval to C2 monitoring. The original paper’s deeper point was that this is how you link individual intrusions into campaigns and recognise the same actor returning.
It explains risk to people who do not work in security. Boards do not respond to CVE counts. They respond to a seven-step story where the organisation has strong controls at steps three and four and nothing at steps one, six and seven.
It is examinable. Attack frameworks — the Cyber Kill Chain, the Diamond Model and MITRE ATT&CK — sit in the objectives of widely held analyst certifications such as CompTIA CySA+, and “walk me through the kill chain” is close to a guaranteed question in SOC analyst interviews. Knowing the stages is the floor; being able to say where the model breaks down is what distinguishes a strong candidate.
Where the model shows its age
Any professional presenting this framework should also be able to say what is wrong with it. Paul Pols, whose Unified Kill Chain was written partly in response, summarises the consensus bluntly: “the most damaging criticisms argue that the CKC is perimeter- and malware-focused.” Three specific limitations matter in practice.
It assumes malware. Stages two and five are built around a weaponised payload and an installed backdoor. An intrusion that logs in with valid stolen credentials and operates entirely through built-in administrative tooling never touches either stage, yet it is one of the most common intrusions there is.
It assumes an outside-in perimeter breach. Malicious insiders, compromised suppliers, misconfigured cloud storage and abused OAuth tokens do not begin outside a boundary and work inwards. Verizon’s 2026 Data Breach Investigations Report — built on more than 22,000 confirmed breaches across 145 countries — found that 48% of breaches now involve a third party, a 60% increase on the previous year.
It stops where real intrusions get interesting. “Actions on objectives” is a single box covering privilege escalation, credential theft, lateral movement, pivoting and exfiltration — which is where attackers spend most of their time and where defenders have the most opportunity.
The tempo has changed too. Mandiant’s M-Trends 2026 reports that the median time between an initial access event and hand-off to a secondary threat group was more than eight hours in 2022; by 2025 that window had collapsed to 22 seconds. The same report puts global median dwell time at 14 days, up from 11, with 52% of intrusions first detected internally rather than by an outside party.
The 2026 DBIR also shows the entry points shifting: exploitation of vulnerabilities is now the most common initial access vector at 31%, up from 20% the year before, while credential abuse — the previous leader — fell to 13%. The human element was present in 62% of breaches, and ransomware featured in 48%. Only 26% of critical vulnerabilities listed in CISA’s Known Exploited Vulnerabilities catalogue were fully remediated during 2025, down from 38%.
None of this makes the kill chain useless. It makes it a starting point rather than a finished map.
How it fits with MITRE ATT&CK and the Unified Kill Chain
The most common interview mistake is treating these as competitors. They operate at different resolutions, and MITRE says so directly. Its own FAQ states that “ATT&CK sits at a lower level of definition to describe adversary behavior than the Cyber Kill Chain,” and that “ATT&CK Tactics are unordered and may not all occur in a single intrusion … whereas the Cyber Kill Chain uses ordered phases to describe high level adversary objectives.”
MITRE began ATT&CK in 2013. Its Enterprise matrix currently catalogues 15 tactics, each containing dozens of concrete techniques with real-world observations attached — the level of detail a detection engineer needs, and far more than a seven-box diagram can hold.
The Unified Kill Chain, first published by Paul Pols in December 2017 out of his master’s thesis at the Cyber Security Academy, is the explicit attempt to merge the two. It defines 18 phases grouped into three cycles — In, Through and Out — which restores the ordered narrative the kill chain gives you while modelling the internal movement it omits.
A workable division of labour: use the Cyber Kill Chain to tell the story and structure the conversation, ATT&CK to specify and hunt the individual behaviours, and the Unified Kill Chain when you need to model what happens after the first foothold.
Put it to work this week
The fastest way to move this from theory to skill is to build the courses of action matrix for something you already know.
- Draw a grid with the seven stages as rows and detect, deny, disrupt as columns — three verbs is enough to start.
- Fill in every control your organisation (or your home lab) actually has, naming the specific tool rather than the category.
- Circle the empty cells. Those are your gaps, in priority order, with evidence.
- Take a recent published incident report and place each described action on the chain. Note which stage the defenders detected it at, and what would have caught it a stage earlier.
That last exercise is the one that builds real intuition, because it forces you to work from what attackers did rather than from what a diagram says they should have done.
Learn this properly with LSCS
Frameworks like the Cyber Kill Chain are the vocabulary of professional cybersecurity work — but reading about them and using them under pressure are different skills. At the London School of Cybersecurity, our hands-on programmes take you from understanding attack lifecycle models to applying them: mapping controls, building detection coverage, running incident scenarios and communicating risk to people who do not share your vocabulary.
Explore our course portfolio to find the programme that matches where you are now, or book a consultation and we will help you work out the right next step.
References
- Hutchins, E. M., Cloppert, M. J. & Amin, R. M. (2011). Intelligence-Driven Computer Network Defense Informed by Analysis of Adversary Campaigns and Intrusion Kill Chains. Lockheed Martin.
- Lockheed Martin, Cyber Kill Chain®.
- MITRE ATT&CK, Frequently Asked Questions and Enterprise Tactics (v19.2).
- Pols, P. (2017), The Unified Kill Chain.
- Verizon (2026), Data Breach Investigations Report, published 19 May 2026.
- Mandiant / Google Cloud (2026), M-Trends 2026.
- CompTIA, Cybersecurity Analyst (CySA+) certification objectives.
Stay Ahead With LSCS
Get critical Cybersecurity updates, events invitations, and industry analysis. Our immersive, hands-on training is the most direct path to a high-growth cyber career.