Cyber Kill Chain: The Seven Stages and How Defenders Use Them

The cyber kill chain is a seven-stage model of how a targeted intrusion unfolds, from the attacker's first research to the moment they act on their goal, introduced by Lockheed Martin in a 2011 paper by Eric Hutchins, Michael Cloppert, and Rohan Amin. The seven stages are reconnaissance, weaponization, delivery, exploitation, installation, command and control, and actions on objectives. Its value to defenders rests on one rule from the paper: the adversary must complete every stage to succeed, so "just one mitigation disrupts the chain." This guide sets out each stage with what defenders can detect or block there, the paper's courses of action matrix, where the model falls short, how it compares with MITRE ATT&CK and the Unified Kill Chain, and a phishing-to-ransomware intrusion mapped stage by stage.

Where the cyber kill chain comes from

The cyber kill chain adapts a military targeting concept to network defense. The paper, Intelligence-Driven Computer Network Defense Informed by Analysis of Adversary Campaigns and Intrusion Kill Chains, starts from U.S. military targeting doctrine, which defines the steps of engaging a target as "find, fix, track, target, engage, assess," citing Joint Publication 3-60, Joint Targeting, from 2007. The authors define a kill chain as "a systematic process to target and engage an adversary to create desired effects" and then turn the idea around: if an intruder must follow a chain of steps to reach a network, defenders can study that chain and break it.

The authors wrote from the experience of Lockheed Martin's Computer Incident Response Team against adversaries running "multi-year intrusion campaigns." Their argument was that traditional incident response "presupposes a successful intrusion," while defenders who analyze every stage can act on "the threat component of risk" before a compromise. Lockheed Martin still presents the framework as "part of the Intelligence Driven Defense model for identification and prevention of cyber intrusions activity" on its Cyber Kill Chain page.

What are the seven stages of the cyber kill chain?

The seven stages run in order, and each is a point where the defender can see or stop the intruder. The stage definitions follow the 2011 paper, the defender actions draw on Lockheed Martin's analyst guide, Gaining the Advantage, and the examples come from the paper's case study and CISA advisories.

The examples link to their sources: CISA's Volt Typhoon advisory of February 7, 2024, the 2011 paper's case study, and CISA's Medusa ransomware advisory of March 12, 2025. Lockheed Martin's guide sums up the stakes for defenders: "Adversaries must completely progress through all phases for success," and "the defender has seven opportunities to break the chain."

The courses of action matrix: detect, deny, disrupt, degrade, deceive, destroy

The paper pairs the seven stages with six defensive actions to form a courses of action matrix, the part of the model most summaries leave out. The actions, detect, deny, disrupt, degrade, deceive, and destroy, come from Department of Defense information operations doctrine, Joint Publication 3-13 from 2006. Each cell asks one question: which control performs this action at this stage?

The paper's example matrix fills the cells with the tools of 2011. Web analytics detect reconnaissance, and a proxy filter denies delivery. Patching denies exploitation, and data execution prevention disrupts it. A tarpit degrades command and control, and a DNS redirect deceives it. At actions on objectives, an audit log detects the activity, quality of service throttling degrades it, and a honeypot deceives the intruder. The tools have changed, but the method holds: lay your current controls on the grid, and the empty cells show where an intrusion passes untouched. The paper adds that defenders "can measure the performance as well as the effectiveness of these actions" and plan investment around the gaps.

Destroy means acting against the adversary's own capability, and it is the one action a private company cannot take against attacker infrastructure. Breaking into an attacker's systems is itself unauthorized access under the Computer Fraud and Abuse Act, 18 U.S.C. 1030, so takedowns go through law enforcement and service providers; confirm the specifics with counsel before anyone touches attacker infrastructure. Deceive deserves more use than it gets. A decoy account has no legitimate user, so any sign-in attempt against it deserves an analyst's attention at whatever stage the intruder has reached.

How the original paper used the kill chain against a real campaign

The paper's case study shows the kill chain doing its most useful job: linking separate intrusions into one campaign. In March 2009, Lockheed Martin's incident response team saw three targeted email intrusion attempts. The first, on March 3, carried a PDF that exploited CVE-2009-0658, which Adobe had documented on February 19 but did not patch until March 10. The second, a day later, came from the same sending address with a PDF that used the same encryption, shellcode, and installer. The third, on March 23, carried a PowerPoint file that exploited a vulnerability unknown to Microsoft and to defenders at the time, later assigned CVE-2009-0556 and patched on May 12, 2009.

The zero-day should have worked. The defenders caught it anyway "due to indicator overlap, though minimal, with Intrusions 1 and 2," because indicators from other stages matched the earlier attempts even though the exploit was new. That is the model's central lesson for a security operations team: a control that depends on one stage fails when the attacker changes that stage, while indicators collected across all seven stages force the attacker to change everything at once. The paper concludes that the adversary had to "avoid all mature indicators to successfully launch an intrusion from that point forward."

Where the kill chain falls short

The kill chain describes a malware-driven intrusion through a network perimeter, which is both its strength and its limit. Paul Pols, who built the Unified Kill Chain, summed up the criticism in one phrase: the model is "perimeter- and malware-focused." Four kinds of attack fit it poorly.

Identity attacks skip the middle of the chain. CISA's advisory on Scattered Spider, first published November 16, 2023, describes actors who pose as help desk staff to obtain credentials, send "repeated MFA notification prompts" until a user accepts, and add their own federated identity provider to a victim's single sign-on tenant. In that path no exploit has to fire and no backdoor has to install, because the attacker signs in with an account the defender trusts. Living off the land does the same on hosts: the Volt Typhoon advisory describes actors who rely on valid accounts and built-in tools to "camouflage their malicious activity with typical system and network behavior," and who kept access to some victims "for at least five years." Insiders start near the last stage. CISA defines insider threat as the threat that an insider "will use their authorized access, intentionally or unintentionally," to do harm, and authorized access leaves nothing to deliver or exploit. Cloud and SaaS attacks often never touch a host the defender owns, so installation and command and control, as the paper defines them, may never occur.

The model also reads as strictly linear, and real intrusions loop. In the paper, actions on objectives covers everything after command and control, including using "the initial victim box for use as a hop point to compromise additional systems." Credential theft, discovery, and lateral movement all live inside that one stage, and that is where most modern detection engineering happens, which is why defenders pair the kill chain with a finer-grained model.

Cyber kill chain vs MITRE ATT&CK vs the Unified Kill Chain

The three models answer different questions, and mature programs use more than one. The kill chain explains where an intrusion can be broken. MITRE ATT&CK, which "sits at a lower level of definition to describe adversary behavior than the Cyber Kill Chain" according to the ATT&CK FAQ, catalogs the specific techniques that detections must catch. The Unified Kill Chain, first published by Paul Pols in December 2017, combines the two ideas into an ordered sequence of 18 phases.

The ATT&CK counts come from the April 2026 release notes. Mapped onto ATT&CK, reconnaissance corresponds to the Reconnaissance tactic, weaponization to Resource Development, delivery and exploitation to Initial Access and Execution, installation to Persistence and Privilege Escalation, command and control to Command and Control, and actions on objectives to Credential Access, Discovery, Lateral Movement, Collection, Exfiltration, and Impact. The Unified Kill Chain's In group runs through reconnaissance, weaponization, delivery, social engineering, exploitation, persistence, defense evasion, and command and control; its Through group covers pivoting, discovery, privilege escalation, execution, credential access, and lateral movement; and its Out group covers collection, exfiltration, impact, and objectives, per Pols's Unified Kill Chain white paper. Our MITRE ATT&CK framework guide covers the technique layer in depth.

How defenders use kill chain thinking today

Defenders use the kill chain for four jobs, and each works best with ATT&CK technique IDs attached to the stages. The first is intrusion analysis: after an incident, reconstruct all seven stages, including the ones that happened before the first alert, because the paper warns that without that reconstruction "one cannot hope to act on the delivery phase of subsequent intrusions." The second is campaign tracking: compare indicators stage by stage across intrusions, as Lockheed Martin did in 2009, so a change at one stage does not hide a known attacker. The third is stopping attacks early, since every stage an attacker completes widens the damage and the response effort. The fourth is measuring detection depth.

Detection depth is BD Emerson's term for a simple measure: of the seven stages, how many have at least one control that a test has shown will detect or deny the behavior at that stage. A team that can only see actions on objectives has a depth of one and will meet most intruders at the ransom note. Record two numbers after every red team engagement and every real incident: the earliest stage at which a control fired, and the depth. A red team supplies the realistic test, because the defenders do not know it is running, and a tabletop exercise rehearses the response decisions at each stage before an attacker forces them. If you are choosing between a penetration test and a red team for this measurement, our comparison of red teaming and penetration testing sets out which one answers which question.

Worked example: a phishing-to-ransomware intrusion, stage by stage

The scenario below follows the behaviors CISA documented for Medusa ransomware affiliates in advisory AA25-071A, arranged as one illustrative intrusion against a mid-sized company. It is an illustrative teaching example with no client data. Each row names the ATT&CK technique and the control that would have broken the chain at that stage.

Now count the chances. The defender needed one control to hold at any of seven stages. It had tested controls at two: email filtering at delivery, which the phish passed, and endpoint detection that fired on encryption at stage seven. That is a detection depth of two with the first alert at the last stage. The most reliable break points were exploitation and installation, because phishing-resistant MFA would have made the stolen password useless, and an allowlist of approved remote access tools would have blocked the foothold even with the password in hand. BD Emerson's rule for budget order follows from the table: fund the control that breaks the earliest stage you can break reliably, then the control that breaks the first stage after the attacker gets in, and treat backups as the control of last resort.

How BD Emerson tests the chain

We test the chain from both ends. A penetration test proves whether the exploitation and installation stages can succeed against a defined scope, such as an internet-facing service or an internal network after an assumed breach. A red team runs the whole chain toward an agreed objective while the defenders work normally, and our report records the stage and ATT&CK technique at which each action was detected or stopped, so the earliest-stage alert and the detection depth become numbers the client can track from one engagement to the next.

Frequently asked questions

What are the seven stages of the cyber kill chain? The seven stages are reconnaissance, weaponization, delivery, exploitation, installation, command and control, and actions on objectives. The attacker researches the target, builds a payload, sends it, triggers it, installs a foothold, opens a control channel, and then steals, encrypts, or destroys data. Because each stage depends on the one before it, a defender who breaks any single stage stops the intrusion.

Who created the cyber kill chain? Lockheed Martin created it. Eric Hutchins, Michael Cloppert, and Rohan Amin described the model in their 2011 paper on intelligence-driven computer network defense, drawing on the experience of Lockheed Martin's incident response team. They adapted it from U.S. military targeting doctrine, whose kill chain runs find, fix, track, target, engage, and assess.

What is the difference between the cyber kill chain and MITRE ATT&CK? The cyber kill chain describes an intrusion as seven ordered stages and shows where a defender can break it. MITRE ATT&CK works at a lower level, cataloging specific techniques with IDs under tactics that are unordered and may not all occur in one intrusion. Use the kill chain to explain an attack and choose break points, and ATT&CK to build and measure the detections at each point.

What is the Unified Kill Chain? The Unified Kill Chain is a model by Paul Pols, first published in December 2017, that combines the cyber kill chain with MITRE ATT&CK. It has 18 phases in three groups: In, for getting into a network; Through, for moving inside it; and Out, for collection, exfiltration, impact, and objectives. It adds social engineering and post-compromise movement, two areas the original model handles poorly.

Is the cyber kill chain still relevant? Yes, for explaining intrusions, tracking campaigns, and deciding where to invest in controls. Its weaknesses are real: it centers on malware and the network perimeter, and it fits identity attacks, insiders, and cloud intrusions poorly. Most teams now pair it with MITRE ATT&CK, using the kill chain for the story of an attack and ATT&CK for the technique-level detail.

Where in the kill chain should you stop an attack? Stop it at the earliest stage you can break reliably, and keep detection at every stage after it. Lockheed Martin calls delivery the first and most important opportunity to block an operation. In practice, exploitation and installation controls such as phishing-resistant MFA and application allowlisting break many intrusions that slip past email filtering.

If you want to know at which stage your defenses would stop a real intrusion, our offensive security team can run a red team against an agreed objective and report the earliest stage at which each action was caught.