What Is the Cyber Kill Chain?

Data Security Knowledge Base 

Cyber Kill Chain Definition

The cyber kill chain is a framework that breaks a cyberattack into sequential stages, from an attacker's initial research through to their final objective. Developed by Lockheed Martin and adapted from a military targeting model, it gives defenders a structured way to understand how intrusions unfold — and where they can be interrupted.

The framework's core premise is that an attacker must complete every stage successfully to achieve their goal. Defenders only need to break the chain at one point to stop the attack. This shifts security thinking from purely perimeter defense toward layered detection across the full attack lifecycle, so that even if an attacker gets in, they can still be caught before doing damage.

What are the 7 stages of the cyber kill chain?

The Lockheed Martin cyber kill chain has seven stages. 
  1. Reconnaissance: The attacker researches the target, gathering employee names, email addresses, and technical details about exposed systems. 
  2. Weaponization: They pair an exploit with a payload, such as embedding malware in a document. 
  3. Delivery: The weaponized payload is transmitted, typically via phishing email, malicious website, or infected USB. 
  4. Exploitation: The code executes, taking advantage of a vulnerability or user action. 
  5. Installation: Malware or a backdoor is installed to establish persistent access. 
  6. Command and control (C2): The compromised system connects back to attacker-controlled infrastructure, giving them remote control. 
  7. Actions on objectives: The attacker achieves their goal: exfiltrating data, deploying ransomware, or moving laterally to higher-value targets.

What is the difference between the cyber kill chain and MITRE ATT&CK?

Both map attacker behavior, but at different levels of detail and structure. The cyber kill chain is a linear, seven-stage model describing the sequence of an attack — it's high-level, easy to communicate, and useful for framing defensive strategy. MITRE ATT&CK is a comprehensive knowledge base of specific adversary tactics, techniques, and procedures (TTPs) observed in real-world attacks, organized into a matrix rather than a linear progression. Where the kill chain says "delivery happens," ATT&CK catalogs the dozens of documented ways attackers actually deliver payloads. In practice, teams use both: the kill chain for strategic framing and executive communication, ATT&CK for detection engineering, threat hunting, and mapping specific defensive coverage.

How do organizations use the cyber kill chain to defend against attacks?

Security teams use the kill chain to map defensive controls against each stage, ensuring they can detect and disrupt an attack at multiple points rather than relying on a single perimeter. At reconnaissance, that means monitoring for scanning activity and reducing publicly exposed information. At delivery, email security and web filtering block malicious payloads before they arrive. At exploitation and installation, patching and endpoint detection stop code from executing or persisting. At command and control, network monitoring flags the beaconing traffic infected systems send to attacker infrastructure — often the last clear window to act before data leaves. The framework is also valuable after an incident: mapping how far an attacker progressed reveals exactly which controls failed and where to invest next.

Related Content

What Are the Cyber Kill Chain Stages? Stage One: Reconnaissance
What Are the Cyber Kill Chain Stages? Stage Two: Weaponization

Knowledge Base