What Is the Cyber Kill Chain?
The Cyber Kill Chain is a model, created by Lockheed Martin, that breaks a targeted intrusion into seven sequential stages — from an attacker’s first research to their final goal. Its value to defenders is simple: an attack that must pass through seven stages can be detected or stopped at any one of them, and the earlier the better.
What are the seven stages?#
Each stage is an opportunity to intervene:
- Reconnaissance — researching the target (OSINT, scanning).
- Weaponization — pairing an exploit with a payload.
- Delivery — getting the weapon to the target (email, web, USB).
- Exploitation — triggering the vulnerability.
- Installation — establishing persistence (a backdoor, implant).
- Command and control (C2) — opening a channel to steer the compromised host.
- Actions on objectives — the actual goal: exfiltration, encryption, destruction.
Notice how the vulnerability, exploit, and payload distinction maps onto stages 1–4.
How do defenders use the Kill Chain?#
By assigning detections and controls to each stage, so a miss at one is caught at another — defense in depth expressed as a timeline:
| Stage | Defensive action |
|---|---|
| Reconnaissance | Reduce attack surface, monitor for scanning |
| Delivery | Email filtering, web proxy, user training |
| Exploitation | Patching, exploit mitigations |
| Installation | EDR, application allowlisting |
| Command and control | Egress filtering, DNS monitoring |
| Actions on objectives | DLP, segmentation, anomaly detection |
The Kill Chain sits alongside threat modeling as a way to reason about attacks systematically. Continue at the Security Fundamentals hub.
Frequently asked questions#
What are the stages of the Cyber Kill Chain?
Lockheed Martin defines seven: reconnaissance, weaponization, delivery, exploitation, installation, command and control, and actions on objectives. The model frames an intrusion as a sequence, so defenders can aim to detect or disrupt the attacker at any single stage rather than only at the final one.
How is the Kill Chain different from MITRE ATT&CK?
The Kill Chain is a high-level, linear model of an intrusion in seven phases. MITRE ATT&CK is a detailed, non-linear matrix of specific tactics and techniques observed in the wild. The Kill Chain tells the story; ATT&CK catalogs the moves. Many teams map ATT&CK techniques onto Kill Chain phases.