Cyber Kill Chain

The cyber kill chain is a model that breaks an intrusion into sequential stages — in the original Lockheed Martin formulation: reconnaissance, weaponization, delivery, exploitation, installation, command and control, and actions on objectives. Its central insight is that an attacker must complete every stage to succeed, while a defender only needs to break one link. Later frameworks such as MITRE ATT&CK expand the idea into a richer catalog of tactics and techniques, but the chain remains the vocabulary most teams use to describe where an attack was caught — or missed.

How it works

Each stage builds on the last. Reconnaissance gathers targets, often through OSINT on staff pages and social profiles. Weaponization and delivery package the approach — a phishing email, a fake login page, a convincing phone call. Exploitation is the moment the attacker gains a foothold, installation and command-and-control make it durable, and lateral movement carries it toward the objective: data theft, fraud, or the encryption payload at the end of a ransomware operation. In the modern chain, the "exploit" is usually human rather than technical — how ransomware starts today is dominated by malicious email, phishing, and stolen credentials rather than software vulnerabilities, which means the earliest and cheapest links to break are conversations, not CVEs.

How to defend against it

Map your controls to stages rather than tools. Early-stage defenses are human and procedural: limit what reconnaissance can harvest, train and simulation-test the delivery stage, and make reporting fast — an employee who flags the phish in minutes severs the chain before exploitation. Mid-stage defenses assume a foothold: least privilege, segmentation, and MFA on internal access slow lateral movement, while monitoring catches command-and-control traffic. Late-stage defenses — backups, exfiltration detection, a rehearsed incident response plan — limit the blast radius when everything earlier failed. Measuring where in the chain your incidents and near misses are caught, and by whom, shows whether your investment matches where your attacks actually begin.