What Is the Cyber Kill Chain? The 7 Stages Explained

A serious cyberattack is not a single event. It is a sequence of steps an attacker has to complete in order, and every step is a chance for you to catch them. The cyber kill chain names those steps so that defense stops being guesswork. Understand the seven stages and you stop asking “are we secure?” and start asking a far better question: at which point in this attack would we actually catch it?

What’s in This Guide

What Is the Cyber Kill Chain?

The cyber kill chain is a framework that describes the stages of a cyberattack from the attacker’s point of view. It was created in 2011 by Lockheed Martin’s Cyber Kill Chain framework as part of their Intelligence Driven Defense model. The term is borrowed from the military, where a “kill chain” is the structure of an attack: find the target, fix its position, track it, engage it. Lockheed Martin’s analysts realized that network intrusions follow a similar, predictable sequence, and that naming each step gives defenders a place to intervene.

That is the whole point. The model does not exist to help attackers. It exists so that defenders can see an attack as a chain of linked steps rather than one overwhelming event. An attacker has to research you, build a weapon, get it to you, run it, keep their access, control it remotely, and then act. If you break any single link in that chain, the attack does not reach its goal. A team that understands the kill chain stops thinking about a single wall around the business and starts building layered checkpoints, so that an intrusion has to survive seven of them in a row to succeed.

The kill chain applies most cleanly to targeted, multi-step intrusions, the kind of patient campaigns that lead to major data breaches and ransomware. Not every attack uses every stage, and modern attacks do not always run in a tidy line. But as a mental model for where your defenses sit, and where the gaps are, it remains one of the clearest tools in security.

Source: Lockheed Martin, Cyber Kill Chain

The 7 Stages of the Cyber Kill Chain

Here is each stage in order: what the attacker is doing, and just as important, where you can break the chain. Notice that the earlier stages happen far from your network and the later stages happen deep inside it. The further an attack progresses, the more it costs you to stop, which is why defense in depth aims to catch intrusions as early as possible.

1Reconnaissance

The attacker researches the target. They harvest employee names and email addresses, study your website and social media, identify the software you run, and scan for internet-facing systems that are exposed or out of date. Most of this happens quietly, using public information, long before anything touches your network.

How you break it: reduce what an attacker can learn. Limit the technical detail exposed publicly, and get a clear picture of everything you have facing the internet through ongoing attack surface management. The less an attacker can map, the harder the next six stages become.

2Weaponization

The attacker builds the weapon. They pair malware with an exploit and package it into something deliverable, such as a booby-trapped Office document, a malicious PDF, or a link to a fake login page. This stage happens entirely on the attacker’s side, so you cannot observe it directly. What you can do is make their chosen exploits useless.

How you break it: keep systems patched. If the vulnerability their weapon targets has already been fixed on your machines, the weapon fails when it arrives. Disciplined patch management quietly defeats a large share of weaponized payloads before they ever run.

3Delivery

The attacker sends the weapon to you. The most common delivery method by far is a phishing email, but delivery also happens through malicious websites, compromised software updates, infected USB drives, or messages over text and social media. This is the first stage that actually reaches your people, and it is often the best place to stop an attack.

How you break it: filter email aggressively and train your team to recognize the bait. Knowing the warning signs of a phishing email turns every employee into a sensor. It matters because the window is tiny: in Verizon’s testing, the median time to click a phishing link is 21 seconds.

4Exploitation

The weapon triggers. When the victim opens the file or clicks the link, the malicious code executes and exploits a vulnerability in the software or the person to gain an initial foothold. Sometimes the “vulnerability” is purely human: a convincing message that persuades someone to enable macros or hand over a password.

How you break it: remove the conditions the exploit needs. Patch software, disable risky features like unsigned macros, enforce least-privilege access so a foothold cannot spread, and run endpoint protection that blocks malicious behavior at the moment of execution.

5Installation

The attacker digs in. They install a backdoor, remote access tool, or other persistent malware so their access survives a reboot or a closed connection. The goal of this stage is staying power: the ability to return whenever they want, quietly.

How you break it: detect and block the install. Modern endpoint detection and response tools watch for the behaviors that signal persistence, such as new services, unusual scheduled tasks, and unauthorized changes to startup routines, and can isolate the machine before the foothold becomes a beachhead.

6Command and Control (C2)

The attacker takes the wheel. The installed malware “phones home,” opening a channel back to a server the attacker controls so they can issue commands remotely. With command and control established, a piece of malware becomes a live, hands-on-keyboard intrusion. The attacker can now move laterally, escalate privileges, and hunt for what they came for.

How you break it: watch the network and cut the cord. Network security monitoring flags the unusual outbound traffic that C2 creates, and network segmentation boxes the intruder in so a single compromised device cannot reach the whole business.

7Actions on Objectives

The attacker gets what they came for. Only now, after six successful stages, does the real damage happen: stealing and exfiltrating data, encrypting systems for a ransomware demand, destroying records, or using your access to attack your customers and partners. This is the stage that makes the headlines and the invoices.

How you break it: contain the blast radius and recover fast. Data loss prevention, tested and isolated backups, and segmentation limit what an attacker can take or destroy, and 24/7 monitoring shortens the time between “they acted” and “we stopped them.”

Source: Lockheed Martin, Cyber Kill Chain | CISA cyber threats and advisories

Cyber Kill Chain vs. MITRE ATT&CK

The cyber kill chain is almost always confused with MITRE ATT&CK, and it is worth clearing up because the two are not competitors. They answer different questions and most mature security teams use both.

The kill chain is a high-level, linear roadmap: seven stages that describe the shape of an attack from start to finish. The MITRE ATT&CK knowledge base is the opposite in grain. It is a large, continuously updated matrix of real-world attacker tactics and the hundreds of specific techniques used to carry them out, based on observed behavior rather than a fixed sequence. If the kill chain is the map that shows the general route an attacker takes, ATT&CK is the GPS with turn-by-turn detail on exactly how they might get there.

In practice, businesses use the kill chain to communicate and to structure defense, mapping their security controls to each of the seven stages so they can see their gaps at a glance. They use ATT&CK to power the day-to-day work of detecting specific attacker techniques inside that structure. One gives you the strategy; the other gives you the detail. You do not have to choose.

Source: MITRE ATT&CK | Lockheed Martin, Cyber Kill Chain

Why the Cyber Kill Chain Matters for Your Business

The kill chain is not an academic diagram. It maps directly onto the numbers that decide whether a breach is a minor incident or a business-ending event. Three figures show why the model’s “break it early” logic is the right one.

First, the stage that reaches you most often is delivery, and phishing dominates it. According to Verizon’s 2024 Data Breach Investigations Report, a non-malicious human element factored into 68% of breaches. The window to react is brutally short: in phishing simulations, the median time for a user to click the link was 21 seconds, and the median time to then hand over data was 28 seconds. In under a minute, an attacker can move from delivery to a foothold.

Second, once an attacker is inside, they are patient. Mandiant’s frontline incident data puts the global median dwell time, the number of days an intruder stays undetected from first compromise to discovery, at about 10 days, down from 16 the year before. That improvement is real, but 10 days is still more than a week in which an attacker sits in stages five, six, and seven, quietly working toward their objective.

Third, the cost lands almost entirely at the final stage. When an attack reaches actions on objectives, the average cost of a data breach reached $4.44 million globally in 2025, per IBM, with a breach lifecycle averaging 241 days to identify and contain. Every one of those dollars accrues at stage seven. Break the chain at stage three or four and that number never arrives.

Read together, these numbers make the business case for the kill chain obvious. Attacks reach you in seconds, sit undetected for days, and only become catastrophically expensive at the end. A defense organized around the chain, with controls at every stage, gives you the maximum number of chances to stop the attack while it is still cheap to stop.

Source: Verizon 2024 DBIR | Mandiant M-Trends 2024 | IBM Cost of a Data Breach 2025

How to Use the Kill Chain to Defend Your Business

The kill chain becomes practical the moment you stop reading it as the attacker’s plan and start reading it as your defensive checklist. The exercise is simple: list the seven stages, then write down what control you have at each one. The empty rows are your gaps.

A layered defense mapped to the chain looks like this:

• Reconnaissance and weaponization: attack surface management to shrink what is visible, and rigorous patching so known exploits fail.
• Delivery and exploitation: email filtering, security awareness training, least-privilege access, and endpoint protection that blocks malicious code as it runs.
• Installation and command and control: endpoint detection and response, network segmentation, and traffic monitoring to catch persistence and the call home.
• Actions on objectives: data loss prevention, tested backups, and round-the-clock monitoring to contain and recover if all else is bypassed.

The hard part is not the list. It is running these controls consistently, watching them 24 hours a day, and responding in minutes rather than the days that dwell-time data warns about. That is precisely what a managed security team does. A well-run provider maps its service to every stage of the chain, so you are not relying on a single tool or a single wall. If you want to see where your own defenses sit against the seven stages, a cybersecurity risk assessment is the fastest way to map them, and pairing it with a recognized structure like the NIST cybersecurity framework turns the map into a plan.

Get a Free Security Assessment
See How Managed Detection and Response Works

Common Questions About the Cyber Kill Chain

Related Terms

Get Fully Managed IT and Security from CNiC Solutions

David McFarlene Founder & CEO

David McFarlene is the owner and founder of CNiC Solutions, a trusted IT services and cybersecurity company serving the Houston, TX area. With over 20 years of experience in managed IT, infrastructure design, cloud solutions, and data security, David helps businesses and homeowners stay protected and productive through dependable, personalized technology support. He leads the CNiC Solutions team with a focus on reliability, transparency, and long-term relationships, ensuring clients always have a knowledgeable expert they can trust.

See Full Bio

IT Services Network Cabling Cloud Solutions Cybersecurity Data Backup & Recovery Managed IT Services Infrastructure Management Telecommunications Virtual CIO (vCIO) WebRTC