Cyber kill chain
Also known as: kill chain, Lockheed Martin Cyber Kill Chain, cyber attack lifecycle
The cyber kill chain is a model that describes a cyberattack as a series of stages: reconnaissance, weaponization, delivery, exploitation, installation, command and control, and actions on objectives.
The idea is that stopping an attacker at any stage breaks the whole chain. While the model is a clear way to explain attacks, critics note it fits old-style malware intrusions better than modern attacks that use stolen passwords and cloud services.
Cyber kill chain, explained at three levels
At home
A cyberattack isn't one step; it's a series of steps, like a burglar who scouts the house, picks the right tool, gets through a window, sneaks in, and carries off the valuables. The kill chain names seven of these steps for online attacks, from researching the target to stealing or locking up data. Stopping any single step can stop the whole break-in.
At work
The cyber kill chain is a model that splits an attack into seven stages: researching the target, preparing a weapon, delivering it, exploiting a weakness, installing malware, contacting the attacker's server, and achieving the goal. Businesses use it to place a defence at each stage, such as email filtering for delivery and patching for exploitation, so an attacker can be stopped early.
At home
The kill chain describes an attack as steps that must happen in order. First, attackers research their target. Then they build a weapon, such as a booby-trapped document, and deliver it, often by email. Opening it exploits a weakness, which installs malware. The malware calls back to the attacker's server for instructions, and only then do they reach their goal, such as stealing or encrypting data. Breaking any link stops the whole attack.
At work
Lockheed Martin published the model in 2011, borrowing military targeting language. Its seven stages map neatly onto controls: threat intelligence for reconnaissance, email filtering for delivery, patching and hardening for exploitation, endpoint protection for installation, DNS filtering and egress controls for command and control, and data loss prevention for actions on objectives. Analysts also use it to plot where an attack was detected. The earlier in the chain a defence acts, the less damage occurs.
At home
While the kill chain fits classic malware attacks, many modern breaches skip several steps. An attacker who buys your stolen password can simply sign in to your email, with no weapon, exploit or malware involved. Phone scams and fraudulent invoices work the same way. In my view, that is why protecting how you sign in now matters more than any antivirus program, because the most common attacks never touch the parts the chain was built to stop.
At work
The model is perimeter-centric and linear, so it handles insider threats, cloud identity abuse and repeated loops inside the network poorly. The Unified Kill Chain, published by Paul Pols in 2017, merges the Lockheed model with ATT&CK into 18 phases grouped as getting in, getting through and getting out. Many teams use the kill chain to explain defence in depth to executives, and ATT&CK for technique-level detection engineering, since each gives a different resolution of the same attack.
Real-world examples
At home
Nadia attended a workplace security session where the trainer walked through the kill chain. She realized that reporting a suspicious email stops an attack at the delivery stage.
At work
Marcus presented the company's security plan to the board of a Calgary credit union using the kill chain, showing which controls stopped attacks at each stage and where gaps remained.
Common confusions
- An attack must go through every stage in order. — Real attacks often skip, repeat, or loop stages, especially when attackers use stolen credentials.
- Stopping malware means stopping the attack. — Many attacks use legitimate tools and logins with no malware at all, so defences need to cover identity and behaviour too.
For analysts
I'd use the kill chain to explain security investments to executives. Showing that each control interrupts a specific stage makes the case for layered defences easy to grasp.
History & origin
The term 'kill chain' comes from military targeting doctrine. In 2011, Lockheed Martin researchers Eric Hutchins, Michael Cloppert, and Rohan Amin published a paper applying it to cyber intrusions, describing seven stages of an advanced persistent threat attack. The 'Cyber Kill Chain' became widely used in security training and vendor marketing through the 2010s. Variations followed, including the Unified Kill Chain in 2017, which added stages for movement inside networks. As attacks shifted toward credential theft and cloud abuse, many teams moved to the more detailed MITRE ATT&CK framework for day-to-day work. In my view, the kill chain remains the best five-minute explanation of how attacks unfold.