The Cyber Kill Chain: 7 Stages and How Defenders Break It

Serious cyberattacks can feel chaotic, but they rarely happen in a single burst. A targeted intrusion unfolds as a sequence of steps, each one setting up the next. The Cyber Kill Chain is the model that maps that sequence — and its central insight still shapes how security teams think in 2026: because an attack is a chain of dependent stages, breaking any one link stops the whole operation. This guide explains all seven stages, how defenders use them to disrupt an attack, the model's limits, and how it stacks up against MITRE ATT&CK and the Unified Kill Chain.

The Cyber Kill Chain is a cybersecurity framework, developed by defense contractor Lockheed Martin in 2011, that breaks a targeted cyberattack into seven sequential stages — Reconnaissance, Weaponization, Delivery, Exploitation, Installation, Command and Control, and Actions on Objectives. Its purpose is defensive: mapping controls to each stage so an attack can be detected and stopped before it succeeds.

Where the Cyber Kill Chain Came From

The term “kill chain” is borrowed from the military, where it describes the structure of an attack: find a target, dispatch force, engage it. Lockheed Martin adapted the idea for computer network defense in a 2011 paper by Eric Hutchins, Michael Cloppert, and Rohan Amin, framing it as part of an approach they called intelligence-driven defense. The model was designed with patient, multi-stage intrusions in mind — the kind associated with advanced persistent threats. More than a decade later it remains one of the most widely taught models in security, valued less for operational precision than for how clearly it communicates the shape of an attack.

The framing matters because it inverts the usual anxiety about defense. An attacker has to succeed at every stage; a defender only has to succeed at one. That asymmetry is the whole point of the model, and it is why the phrase most associated with it is simply break the chain.

The Seven Stages of the Cyber Kill Chain

Each stage represents something the attacker must accomplish before moving on. Understanding what happens at each — and what a defender can do about it — is what turns the model from a diagram into a strategy.

1. Reconnaissance

The attacker researches the target: employees, email addresses, technologies in use, exposed services, and likely weaknesses. Much of this draws on publicly available information and leaves few traces, which makes it one of the hardest stages to detect. Defenders counter it by reducing their attack surface and limiting how much useful information is exposed to the open internet.

2. Weaponization

The attacker prepares the payload, typically by pairing malware with an exploit and packaging it into something deliverable, such as a booby-trapped document. This happens on the attacker's own infrastructure, so defenders cannot observe it directly — but threat intelligence on known malware families and exploit kits helps them recognize what arrives at the next stage.

3. Delivery

The weaponized payload is transmitted to the target — most often through a phishing email, a malicious link, a compromised website, or an infected USB drive. Delivery is the first moment the attacker makes contact, and therefore the first major opportunity to block them, with email filtering, web controls, and user awareness.

4. Exploitation

The payload executes, exploiting a vulnerability or tricking a user into running it, and the attacker gains an initial foothold. Sophisticated operations may combine several flaws here; our guide to how exploit chains work covers that technique. Prompt patching and exploit mitigations close much of this stage off.

5. Installation

The attacker installs malware or plants a backdoor to establish persistent access, so their foothold survives a reboot or a password change and they can return at will. Endpoint detection and response (EDR) and application allowlisting are the controls aimed squarely at this stage.

6. Command and Control (C2)

The compromised system beacons back to the attacker's infrastructure, opening a channel through which they can issue commands and operate remotely inside the network. Because this traffic has to cross the network boundary, it is one of the more detectable stages — network monitoring, DNS filtering, and egress controls all target it.

7. Actions on Objectives

With control established, the attacker pursues their actual goal. This is where they use lateral movement and privilege escalation to reach valuable systems, then steal data, deploy ransomware, or cause disruption. By this point the damage is imminent, so segmentation, data loss prevention, and least-privilege access are the last lines of defense.

How Defenders Break the Chain

The practical value of the Cyber Kill Chain is that it lets a security team lay its controls out against the stages an attacker must pass through and see, at a glance, where the gaps are. Security awareness training and email filtering target Delivery. Prompt patching closes off Exploitation. EDR disrupts Installation. Network monitoring catches Command and Control. Segmentation and data loss prevention limit Actions on Objectives. Mapped this way, weak spots become obvious — and so does the fact that the earlier a control intervenes, the less damage an intrusion can do.

This is also where the model connects to intelligence work. Feeding indicators from each stage back into cyber threat intelligence — the domains, hashes, and techniques an adversary reuses — lets defenders anticipate the next campaign rather than merely react to the current one. That feedback loop is exactly what Lockheed Martin meant by intelligence-driven defense.

Cyber Kill Chain vs MITRE ATT&CK vs the Unified Kill Chain

The Cyber Kill Chain is often set against MITRE ATT&CK, but the two are complementary rather than competing. The Kill Chain is linear and high-level: seven stages in a fixed order, ideal for explaining the overall shape of an attack to executives or new analysts. MITRE ATT&CK is a far more detailed, non-linear knowledge base cataloguing hundreds of specific adversary tactics and techniques observed in the wild — the tool of choice for detection engineering and threat hunting. Many teams use the Kill Chain to communicate strategy and ATT&CK for the granular detail underneath it.

A third model, the Unified Kill Chain, was proposed by researcher Paul Pols in 2017 specifically to bridge the two. It combines Lockheed Martin's chain with MITRE ATT&CK into 18 ordered phases spanning three broad efforts — gaining an initial foothold, moving through the network, and acting on the objective. Its aim is to fix the original's biggest blind spots: the messy internal-movement phase and attacks that never touch the perimeter in a conventional way. For most readers, the Kill Chain remains the clearest starting point; the Unified Kill Chain and ATT&CK are where teams go for operational depth.

Limitations of the Cyber Kill Chain

The model is valuable but not perfect, and knowing its limits keeps it useful. It was built around malware-delivered, perimeter-focused intrusions, so it fits less cleanly with attacks that rely purely on stolen credentials, insider access, or the abuse of legitimate cloud services — cases where there is no malware to “install” and no clear perimeter to cross. Its strictly linear shape can also understate how real attackers loop back, run stages in parallel, or skip steps entirely. Credential-based intrusions in particular can jump almost straight to Actions on Objectives.

None of this makes the model obsolete. It means the Cyber Kill Chain is best treated as a conceptual foundation — a shared vocabulary for how an intrusion unfolds — and paired with more granular frameworks for day-to-day detection. It remains an excellent way to understand and explain the arc of an attack, which is exactly what it was built to do.

Frequently Asked Questions

What are the seven stages of the Cyber Kill Chain?

Reconnaissance, Weaponization, Delivery, Exploitation, Installation, Command and Control, and Actions on Objectives. Each stage must be completed before the next, which is why stopping any single stage halts the whole attack.

How do defenders use the Cyber Kill Chain?

They map security controls to each stage and look for gaps. Because the stages are sequential, the goal is to “break the chain” as early as possible — a control that stops an attack at Delivery prevents far more harm than one that only catches it at Actions on Objectives.

Is the Cyber Kill Chain still relevant in 2026?

Yes. Newer frameworks such as MITRE ATT&CK and the Unified Kill Chain add operational detail, but the Cyber Kill Chain remains one of the clearest ways to understand and communicate how a cyberattack progresses, and it is still widely taught and used as a foundational model.

Further Reading

• Lockheed Martin — The Cyber Kill Chain
• Hutchins, Cloppert & Amin — Intelligence-Driven Computer Network Defense (2011)
• MITRE ATT&CK — Enterprise Matrix
• Paul Pols — The Unified Kill Chain
• CISA — Cybersecurity Best Practices