The cyber kill chain is a model that breaks a cyberattack into seven ordered stages, from the moment an attacker first researches a target to the moment they steal data or cause damage. Lockheed Martin analysts published it in 2011 as a way for defenders to think like the adversary and stop an intrusion before it reaches its goal. Understand the seven stages and a chaotic-looking breach turns into a predictable sequence you can interrupt at any point.
This guide walks each stage from both sides: what the attacker does, and how a defender detects and breaks it. Every phase also maps to a concrete skill you can practice hands-on. The same seven-step path is exactly what you follow in HackerDNA's network penetration testing course, where you run recon, exploitation, and post-exploitation against a live target in the browser.
TL;DR: The cyber kill chain is a seven-stage model of how a targeted attack unfolds: reconnaissance, weaponization, delivery, exploitation, installation, command and control, and actions on objectives. Created by Lockheed Martin in 2011, it treats an intrusion as a chain where breaking any single link stops the whole attack. Defenders use it to map controls to each stage and detect an attacker early, ideally before exploitation. Its main limitation is a perimeter and malware focus, which is why many teams now pair it with the more granular MITRE ATT&CK framework.
In this guide:
What Is the Cyber Kill Chain?
What is the cyber kill chain? The cyber kill chain is a framework that describes a cyberattack as a sequence of seven stages an attacker must complete in order to succeed. If a defender disrupts any one stage, the attacker cannot reach the next, and the intrusion fails. It gives security teams a shared language for where an attack is and what to do about it.
The term comes from the military. A traditional "kill chain" describes the steps to identify and engage a target: find, fix, track, target, engage, assess. Lockheed Martin adapted that idea to network defense in a 2011 paper by Eric Hutchins, Michael Cloppert, and Rohan Amin, arguing that intrusions are not single events but campaigns with distinct, detectable phases. They called the approach intelligence-driven defense.
The core insight is defensive, not offensive. An attacker has to get every stage right. A defender only has to catch one. That asymmetry is the whole point: the earlier in the chain you detect activity, the cheaper and safer it is to shut down. Catching reconnaissance is an annoyance for the attacker. Catching actions on objectives means the data is already leaving.
For anyone learning offensive security, the kill chain is also a map of a full engagement. A real penetration testing assessment moves through these same phases, which is why understanding the model makes both attackers and defenders sharper.
The 7 Stages of the Cyber Kill Chain
What are the 7 stages of the cyber kill chain? The seven stages are reconnaissance, weaponization, delivery, exploitation, installation, command and control, and actions on objectives. Each stage depends on the one before it, so the model reads as a straight line from research to impact. Here is what happens in each, and how a defender spots it.
1. Reconnaissance
The attacker researches the target. That means gathering email addresses, employee names, technologies in use, exposed services, and anything else that narrows down a way in. Some of this is passive and silent, pulled from public sources like the company website, job postings, and social media. Some is active, such as scanning for open ports and running services.
Defenders detect the active side by watching for port scans and unusual crawling, and reduce the passive side by limiting what they publish. On the offensive side, this is where tools like Nmap earn their place. Our Nmap cheat sheet covers the exact commands used to map a target's open ports and services during this phase.
2. Weaponization
The attacker builds the thing that will actually break in. Classically this means pairing an exploit with a payload, for example embedding a malicious macro in a document or bundling an exploit into a file that looks harmless. This stage happens entirely on the attacker's own machine, so there is nothing on the target to detect yet.
Because weaponization is invisible to the defender, the defensive value here is intelligence: understanding which payloads and delivery formats attackers favor lets you tune detection for the stages that follow. You cannot see the weapon being built, but you can prepare for how it usually arrives.
3. Delivery
The weapon reaches the target. The most common delivery method by far is a phishing email with a malicious attachment or link. Others include compromised websites, infected USB drives, and exploiting an exposed service directly. Delivery is the first stage where the attacker touches your environment, which makes it the first real chance to block them.
This is where email filtering, link analysis, and user awareness training pay off. A phishing message that never reaches an inbox is an attack that ends at stage three. Web filtering and blocking known-bad domains cut off the drive-by-download route.
4. Exploitation
The payload triggers. A user opens the attachment, a vulnerable service parses the malicious input, and the attacker's code runs. This is the moment a flaw in software or human behavior turns into actual code execution on the target. Web application bugs like SQL injection and command injection live here too, when an internet-facing app is the entry point.
Patching removes the vulnerabilities that exploitation relies on. Endpoint protection and application hardening catch or block the exploit as it fires. To understand this stage from the attacker's chair, practicing web exploitation on intentionally vulnerable targets is the fastest way to see how a single unchecked input becomes a foothold.
5. Installation
The attacker establishes persistence. Getting code to run once is not enough, because a reboot or a closed session would end the access. So they install a backdoor, create a scheduled task, add a service, or drop a web shell that survives and lets them return at will. A common form of this foothold is a reverse shell that calls back out to the attacker.
Defenders hunt for the artifacts persistence leaves behind: new services, odd scheduled tasks, unexpected startup entries, and files in places they should not be. Our reverse shell cheat sheet shows how attackers set up that callback, which is exactly what blue teams learn to recognize in logs.
6. Command and Control (C2)
The installed foothold phones home. The compromised machine opens a channel to the attacker's server so it can receive instructions and send data back. Modern C2 hides inside normal-looking traffic, using HTTPS, DNS, or even trusted cloud services to blend in with everything else leaving the network.
This stage is a strong detection point because the traffic has to cross the network boundary. Monitoring outbound connections, inspecting DNS for tunneling, and blocking known C2 infrastructure all break the channel. Cut the C2 link and the attacker is left with a foothold they can no longer steer.
7. Actions on Objectives
The attacker does what they came to do. Now that they have control and a channel, they pursue the actual goal: stealing data, encrypting systems for ransom, tampering with records, or moving deeper into the network toward higher-value targets. Reaching this stage usually involves privilege escalation and lateral movement across the internal environment.
By this point detection is harder and the damage is closer, which is why the model pushes defenders to catch attackers earlier. Understanding how attackers climb from a low-privilege foothold to full control is core blue-team knowledge; our privilege escalation guide breaks down the techniques used in this final phase.
Cyber Kill Chain vs MITRE ATT&CK
These two frameworks get compared constantly, and people new to security often think they have to pick one. They solve different problems and work well together.
The cyber kill chain is linear and strategic. It gives you seven big phases and a simple story: an attack moves left to right, so push your detection as far left as you can. It is easy to explain to a manager and a good mental model for structuring defenses at a high level.
MITRE ATT&CK is a granular knowledge base of real adversary behavior. Instead of seven phases it catalogs fourteen tactics and hundreds of specific techniques, each documented with real-world examples and detection guidance. It is not linear, because real attackers loop, skip, and repeat steps. ATT&CK tells you exactly how a technique works and how to spot it.
| Aspect | Cyber Kill Chain | MITRE ATT&CK |
|---|---|---|
| Structure | Linear, 7 stages | Matrix, 14 tactics, hundreds of techniques |
| Level | High-level strategy | Granular, technique by technique |
| Created by | Lockheed Martin, 2011 | MITRE, first released 2013 |
| Best for | Explaining attack flow, planning layered defense | Threat detection, red-team mapping, gap analysis |
| Weakness | Perimeter and malware focused | Large and complex to adopt fully |
The practical answer: use the kill chain to explain the shape of an attack and structure your layers, then use ATT&CK to get specific about the techniques you need to detect at each layer. One is the map, the other is the street-level detail.
How Defenders Break the Kill Chain
The reason the model matters is that breaking a single link stops the attack. Lockheed Martin paired the seven stages with a matrix of six defensive actions you can take against activity at any stage: detect, deny, disrupt, degrade, deceive, and destroy.
- Detect. Know the activity is happening, through logging, intrusion detection, and monitoring. You cannot act on what you cannot see.
- Deny. Stop the activity outright, for example by patching a vulnerability or blocking an email so delivery never lands.
- Disrupt. Interrupt an attack in progress, such as killing a malicious process or severing a C2 connection mid-session.
- Degrade. Slow the attacker down so their effort costs more than it returns, buying time to respond.
- Deceive. Feed the attacker false information, most obviously with honeypots that waste their time on fake targets.
- Destroy. Neutralize the threat, usually the last resort once an attack is confirmed and contained.
Mapping these actions across the seven stages produces a layered defense. If phishing beats your email filter at delivery, endpoint protection can still deny exploitation. If a foothold installs anyway, network monitoring can disrupt its command and control. No single control has to be perfect, because the attacker needs every stage and you need only one clean break. This layered thinking is the daily work of a defender; if that side appeals to you, our SOC analyst career guide covers what the blue-team path looks like.
A Real Attack Through the Kill Chain
Models are easier to trust when you walk a concrete example through them. Take a common intrusion pattern that ends in ransomware, and watch it move stage by stage.
It starts with reconnaissance: the attacker scrapes LinkedIn for finance-team names and finds the company uses a well-known invoicing tool. In weaponization they craft an invoice document with a malicious macro tailored to that tool. Delivery is a convincing email to an accounts-payable clerk referencing a real vendor. On exploitation, the clerk enables macros and the payload runs. During installation it creates a scheduled task so the access survives a reboot. The foothold then opens command and control over HTTPS that looks like ordinary web traffic. Finally, in actions on objectives, the attacker escalates privileges, spreads to file servers, and detonates ransomware.
Now read it as a defender. Email filtering could have stopped delivery. Disabling macros by default could have blocked exploitation. Endpoint monitoring could have flagged the scheduled task at installation. Outbound traffic inspection could have caught the C2 beacon. Any one of those breaks the chain before the ransomware ever runs. The single-point-of-failure fear you have about security flips into a single-point-of-rescue: the attacker has to win seven times in a row, and you only have to win once.
When testing real environments, this is exactly how a defender reconstructs an incident after the fact, walking the evidence backward through the stages to find where it started and where it could have been stopped. Practicing the offensive path first is what makes that reconstruction intuitive.
Limitations of the Cyber Kill Chain
The model is useful, but it is fifteen years old and it shows. Treating it as gospel leads to blind spots, so it is worth being honest about where it falls short.
Its biggest weakness is a perimeter and malware focus. The classic chain assumes an outsider breaking in with a malicious payload. It maps poorly to an insider who already has legitimate access, to credential theft where the attacker simply logs in, and to attacks that never drop a file at all. If there is no weaponized malware, several stages barely apply.
It also struggles with the cloud. The model was written for a world of on-premises networks with a clear inside and outside. In cloud and identity-driven environments, where the boundary is an API and an access token rather than a firewall, the neat left-to-right flow gets fuzzy. Attacks on misconfigured storage buckets or over-permissioned roles do not fit the seven boxes cleanly.
And real attacks are rarely as linear as the diagram. Adversaries loop back, run stages in parallel, and skip steps entirely. This is the main reason many teams now lead with MITRE ATT&CK for detection engineering and keep the kill chain as the high-level story. The right way to use it in 2026 is as a teaching model and a strategic frame, not as a literal checklist every attack obeys.
Legal and Ethical Considerations
Critical reminder: Understanding how attacks unfold is defensive knowledge, but practicing the offensive stages requires explicit authorization. Running reconnaissance, exploitation, or command and control against systems you do not own or have written permission to test is unauthorized access. In the United States that falls under the Computer Fraud and Abuse Act (CFAA, 18 USC 1030); the UK enforces the Computer Misuse Act 1990; and the EU applies Directive 2013/40/EU. Always get written authorization before testing any system.
The kill chain is taught to defenders precisely so they can build controls, respond to incidents, and reason about adversaries. The reference standard for the response side is the NIST incident handling guide (SP 800-61), which maps closely to detecting and containing an attacker as they move through these stages.
There are three places to practice the offensive techniques legally: authorized penetration testing engagements under a signed statement of work, bug bounty programs within their published scope, and sandboxed lab platforms built to be attacked. HackerDNA's labs are the third: real vulnerable targets with zero legal risk while you learn the full chain from both sides.
Frequently Asked Questions
Who created the cyber kill chain?
Lockheed Martin created the cyber kill chain, publishing it in a 2011 paper by Eric Hutchins, Michael Cloppert, and Rohan Amin. They adapted the military concept of a kill chain to computer network defense, arguing that intrusions are structured campaigns with detectable phases rather than one-off events. The approach is often called intelligence-driven defense.
What are the 7 stages of the cyber kill chain?
The seven stages are reconnaissance, weaponization, delivery, exploitation, installation, command and control, and actions on objectives. They run in order, each depending on the one before it, so an attacker must complete every stage to succeed. Breaking any single stage stops the whole attack, which is the core idea behind the model.
What is the difference between the cyber kill chain and MITRE ATT&CK?
The cyber kill chain is a linear, high-level model of seven attack phases, ideal for explaining the shape of an intrusion. MITRE ATT&CK is a detailed, non-linear knowledge base of fourteen tactics and hundreds of specific techniques used for detection and red-team mapping. Most teams use the kill chain for strategy and ATT&CK for technique-level detail.
Is the cyber kill chain still relevant in 2026?
Yes, as a teaching model and a strategic frame, though not as a literal checklist. It remains an excellent way to explain how attacks progress and to structure layered defenses. Its limits show with insider threats, credential-based attacks, and cloud environments, which is why many teams pair it with MITRE ATT&CK for detailed detection work.
Which stage is the best place to stop an attacker?
As early as possible, ideally before exploitation. Detecting reconnaissance or blocking delivery costs the attacker very little and costs you almost nothing to recover from. The later you catch an intrusion, the closer it is to actions on objectives, where data is already leaving or systems are already encrypted and the damage is real.
How does the kill chain help defenders?
It lets defenders map security controls to each stage and build layered defense, so no single control has to be perfect. Because the attacker must complete every stage but the defender only has to break one, the model turns a single point of failure into many chances to intervene. It also gives teams a shared vocabulary for where an attack is and what to do next.
Your Next Steps
The cyber kill chain is worth internalizing because it changes how you see an attack. Instead of one terrifying event, a breach becomes a sequence with seven chances to intervene, and your job as a defender is to make sure the attacker fails at even one of them. As an attacker or pentester, it is the checklist your own engagements follow from first scan to final objective.
The fastest way to make the model stick is to run the stages yourself. Start with the Hack the Box lab to move from reconnaissance to a foothold to privilege escalation on a single target, then take on the full network penetration testing course to walk recon, exploitation, command and control, and post-exploitation across a live network end to end.
HackerDNA's free tier gives you browser-based labs with no credit card and no local setup. Learn the chain from both sides, and you will spot where every attack can break.
Last reviewed: July 2026.
