The Cyber Kill Chain: Seven Stages and Where to Break It

The Cyber Kill Chain models an intrusion as a sequence of stages an attacker must complete in order. Its value is the framing rather than the list: the attacker has to succeed at every stage, and the defender only has to break one. That asymmetry runs the other way from the usual "attacker only needs to be right once" and it is the point of the model.

The seven stages, and what breaks each

1. Reconnaissance. Gathering information about the target — staff names and email formats from public sources, exposed services from scan indexes, technology from job postings. Almost entirely outside your visibility. The counter is reducing what you publish and monitoring what is exposed, as covered under OSINT collection.

2. Weaponization. Building the deliverable — pairing an exploit or payload with a document, a link, or an installer. This happens entirely on the attacker's side, so there is nothing to detect and nothing to block. It is the stage with no defensive action, which is worth knowing because exam questions ask.

3. Delivery. Getting it to the target: email, a compromised website, removable media, an exposed service. This is the first point of contact and the first real opportunity. Email authentication, attachment and link inspection, web filtering, and removing internet exposure from services all act here.

4. Exploitation. The code executes, either by exploiting a vulnerability or by persuading a user to run it. Patching removes the first path; macro policy, application allowlisting and awareness training address the second.

5. Installation. Establishing a persistent foothold — an implant, a scheduled task, a service, a new account. Endpoint detection and monitoring of autostart locations catch this, and the mechanisms are enumerated under persistence techniques.

6. Command and control. The foothold contacts the attacker for instructions. Because this crosses the network repeatedly, it is one of the most detectable stages — DNS filtering, egress restriction, and beacon pattern analysis all act here.

7. Actions on objectives. Whatever the attacker came for: data theft, encryption, fraud, destruction. Data loss prevention, segmentation limiting reach, and immutable backups reduce the damage once you are here.

Using it as a coverage map

The practical exercise is to list your controls against the seven stages and look for the gaps. Most organizations discover they are heavily weighted toward delivery and exploitation — mail filtering and patching — and thin on installation and command and control, which is where a successful intrusion actually becomes visible.

Weighting matters too. Controls late in the chain act after the attacker is already inside, so they need to be fast, while controls early in the chain act on volume. Both are necessary; relying on one end is how long dwell times happen.

The model also structures incident analysis. Placing each observed event at its stage produces a timeline that shows how far the intrusion progressed and which control should have caught it — the honest version of a lessons-learned exercise, feeding directly into the improvements your incident response playbooks record.

Where the model falls short

Be able to criticize it, because that is a common exam angle.

It is linear, and real intrusions loop — an attacker lands, moves laterally, and repeats exploitation and installation on each new host. The model has no good representation of lateral movement, which is where most of the time in a real incident is spent.

It is perimeter-oriented and malware-centric, so it fits an insider misusing legitimate access poorly, and it fits an attack that uses only stolen credentials and built-in tools poorly too — there may be no weaponization, no installation, and nothing to detect at those stages at all.

And the stages are coarse. "Actions on objectives" covers everything from a single file copy to a months-long campaign.

Kill chain and ATT&CK

They answer different questions and are complementary. The kill chain gives a small, memorable sequence that is excellent for explaining defence in depth to people who do not work in security, and for structuring a control coverage conversation.

MITRE ATT&CK catalogs hundreds of specific techniques mapped to tactics, with no assumption of order, which handles lateral movement and repetition properly and is what detection engineering actually works from — the basis of the coverage testing described under adversary emulation.

Use the kill chain to communicate and ATT&CK to build.

Exam angles

Know the seven stages in order and at least one control for each. Remember that weaponization occurs entirely on the attacker's side and offers no defensive opportunity. Understand the core premise that breaking any single stage stops the intrusion. Be ready to name the model's limitations — linearity, weak handling of lateral movement and insider threat — and to contrast it with ATT&CK as a non-sequential technique catalog.