What Is the Cyber Kill Chain?
The Cyber Kill Chain maps the seven stages of a cyberattack from reconnaissance to final objectives.
How the Cyber Kill Chain Maps Attacks
Reconnaissance
Attackers gather intelligence about their target before taking any action against it. OSINT sources — LinkedIn employee profiles, job postings that reveal technology stack, domain registration records, code repositories, and technical conference presentations — provide the information needed to identify targets, understand the technology environment, and select attack techniques appropriate to the target's defenses.
Weaponization
The attacker creates the delivery mechanism — a phishing email with a malicious attachment, an exploit payload targeting a specific vulnerability, a watering hole site targeting the victim's industry. Weaponization occurs entirely within the attacker's environment and is invisible to defenders.
Delivery
The weaponized attack is transmitted to the target — phishing email delivered to the victim's inbox, exploit directed at an internet-facing service, malicious USB drive left in a parking lot. The delivery phase is the first point at which defenders have visibility into the attack, and the first opportunity to disrupt it.
Exploitation
The delivered weapon exploits a vulnerability to execute attacker-controlled code on the victim's systems. The exploitation may be software vulnerability exploitation, credential theft through phishing, or social engineering that causes an employee to execute a malicious action.
Installation, Command and Control, Actions on Objectives
After exploitation, the attacker installs persistence mechanisms, establishes command and control communication, and pursues their objectives — data theft, ransomware deployment, espionage, sabotage. Each phase requires successful completion of the previous phase, which means defenders who interrupt the kill chain at any phase prevent the attack from achieving its objectives.
Kill Chain-Based Defense
The kill chain model's primary value is organizing defensive investments against the phases where disruption is most cost-effective. Denying Reconnaissance by minimizing public information exposure, monitoring for scanning activity, and protecting employee information reduces attacker intelligence. Denying Delivery through email security, web filtering, and network controls blocks initial access attempts. Denying Exploitation through patch management and vulnerability reduction eliminates the exploitable conditions that exploitation requires. Denying Installation, Command and Control, and Actions through EDR, network monitoring, and anomaly detection catches attackers who succeed in earlier phases.
The kill chain model argues that defenders should focus on early-phase disruption because the cost of disruption increases as attacks progress. Blocking a phishing email at delivery is cheap. Responding to ransomware after domain compromise is expensive. Defense-in-depth aligned to kill chain phases provides multiple opportunities to disrupt an attack, any one of which is sufficient to prevent success.
Kill Chain vs. MITRE ATT&CK
The Cyber Kill Chain and MITRE ATT&CK serve related but different purposes. The kill chain provides a high-level conceptual model of attack progression. ATT&CK provides a detailed taxonomy of specific techniques used at each phase. The kill chain is useful for executive communication and high-level defense planning. ATT&CK is useful for technical teams developing specific detection rules and evaluating specific technique coverage.
Most mature security programs use both: the kill chain model to communicate defense strategy and prioritize control investments, and ATT&CK to translate strategy into specific detection engineering and validation activities.
Related Reading
What is the Cyber Kill Chain?
The Cyber Kill Chain is a framework developed by Lockheed Martin in 2011 that breaks a cyberattack into seven sequential stages: reconnaissance, weaponization, delivery, exploitation, installation, command and control, and actions on objectives. It was the first widely adopted model for describing the lifecycle of an intrusion and remains a useful shorthand for executive briefings and incident reports even as more granular frameworks have emerged.
How does the Cyber Kill Chain differ from MITRE ATT&CK?
The Kill Chain is linear and high-level, describing seven phases attackers progress through in order. MITRE ATT&CK is non-linear and granular, cataloging hundreds of specific techniques across 14 tactics that attackers revisit in any sequence. Kill Chain is easier to explain to executives and works well for breach narratives; ATT&CK is more useful for SOC engineering and detection coverage analysis. They are complementary, not competitive.
What are the seven stages of the Cyber Kill Chain?
Reconnaissance is research and target selection. Weaponization couples exploit with payload. Delivery transmits the weapon, typically via email, web, or USB. Exploitation triggers vulnerable code. Installation establishes persistence. Command and control opens a remote channel to the implant. Actions on objectives is the goal, whether exfiltration, ransomware deployment, or destruction. Each stage offers defenders an opportunity to detect and disrupt the attack.
How is the Cyber Kill Chain used by SOC teams and vendors?
SOC teams use Kill Chain stages to map detection and response capabilities, ensuring visibility at each phase. Many EDR and SIEM vendors including Microsoft Defender, CrowdStrike, and Splunk tag detections to the chain to help analysts understand where in the attack lifecycle an alert sits. Incident reports often narrate breaches in Kill Chain terms because the linear structure communicates clearly to non-technical executives.
How does the Kill Chain inform detection and response strategy?
The strategic insight is that defenders only need to break the chain at one stage to stop the attack. Early-stage disruption at reconnaissance or delivery is cheap and high-leverage. Late-stage detection at command and control or actions on objectives means damage may already be done. Mature programs invest in detection across all seven stages with the heaviest coverage at delivery, installation, and C2.
Is the Cyber Kill Chain still relevant in 2026?
It remains relevant as a narrative and educational tool, particularly for boards and non-technical stakeholders. Operationally, most mature SOCs have migrated detection engineering work to MITRE ATT&CK because its granularity better describes modern attacks involving cloud, identity, and supply chain. The two frameworks coexist: Kill Chain for the story, ATT&CK for the detection.
What is the first step in operationalizing the Cyber Kill Chain?
Map your current security controls to each of the seven stages and identify gaps. Most organizations discover heavy investment in delivery prevention with email filtering and web proxies, decent installation coverage from EDR, and surprisingly thin telemetry at reconnaissance and command and control. That gap analysis becomes a concrete roadmap for the next investment cycle.
Real-World Example: APT1 — The Report That Made Kill Chain Famous
Mandiant's 2013 APT1 report documented Chinese military unit 61398's multi-year campaign against US organizations using kill chain analysis as the organizing framework. The report traced attack campaigns from spear phishing delivery through long-term Command and Control operations, demonstrating that the same kill chain phases repeated consistently across hundreds of victim organizations. The report's use of kill chain analysis provided a systematic framework for understanding an attacker who had previously been analyzed as a series of disconnected incidents, and established kill chain methodology as a standard tool for threat intelligence reporting.
Sequential phases that every cyberattack must progress through — and each phase represents a defensive opportunity. An attacker who succeeds in all seven phases achieves their objectives; a defender who disrupts any single phase prevents the attack from reaching completion.