The 7 phases of the Cyber Kill Chain: map the attack to break the intrusion

A map of the attack, phase by phase

The Cyber Kill Chain, created by Lockheed Martin in 2011, describes an intrusion as an ordered sequence of phases. The principle is simple and powerful: to succeed, the attacker must complete every phase; the defender only has to break one to derail the whole operation. Each phase thus becomes an opportunity for detection and response.

The seven phases

• Reconnaissance — gathering intelligence on the target (mostly passive, hard to detect).
• Weaponization — the attacker couples an exploit to a payload, out of your reach.
• Delivery — transmitting the payload: the first direct contact and the first big chance to intercept.
• Exploitation — the code runs and initial access is obtained.
• Installation — temporary access becomes persistent presence.
• Command & Control — the host opens a channel to the attacker; it generates observable traffic, one of the best detection windows.
• Actions on Objectives — exfiltration, sabotage, or encryption for extortion.

Break one link: defense in depth

The model's practical value is in placing controls across several phases, so the failure of one doesn't mean total compromise. And the earlier the link is broken, the cheaper the defense: stopping at Delivery costs far less than responding to an exfiltration in progress.

Where it shines — and where it fails

The Kill Chain is an excellent strategic map and a common language to communicate attacks. But it was designed for an external, linear, malware-centric adversary — and it is not, on its own, a complete tactical detection model in the era of stolen identity, cloud, and fragmented eCrime. The practical takeaway is a layer correction, not a discard.

The bridge to MITRE ATT&CK

The Kill Chain says which phase you're in (high level); MITRE ATT&CK says how it happens, at the observable-technique level. The two complement each other — and that bridge is what turns the model into real detection.

The full guide

Applied at the right layer, the Cyber Kill Chain organizes defense in depth and serves as the skeleton for more granular models. To walk that path — history, the 7 phases, implementation, limits, and integration with ATT&CK — we wrote the e-book Cyber Kill Chain.

⛓️ Download it for free: Cyber Kill Chain — Understanding and Practical Application