Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstalliTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
The Cyber Kill Chain® is Lockheed Martin’s seven-stage framework for describing how an adversary may progress through an intrusion and where defenders might detect or disrupt it. Its stages are Reconnaissance, Weaponization, Delivery, Exploitation, Installation, Command and Control, and Actions on Objectives. It is a high-level analysis model—not a rule that every real attack follows the same path.
What is the Cyber Kill Chain?
Lockheed Martin developed the Cyber Kill Chain as part of its Intelligence Driven Defense model. It gives security teams a shared vocabulary for organizing an intrusion narrative: what an adversary appears to have done, what might happen next, and where a defensive measure could interrupt progress. The framework presents seven phases in a particular order.
That sequence is a way to structure analysis, not a guarantee that every incident contains every phase or unfolds neatly from one to the next. Real activity may be incomplete, repeated, or difficult to observe. Use the model to reason about evidence and possible intervention points, rather than to force an incident into a fixed script.
What are the seven stages of the Cyber Kill Chain?
- Reconnaissance: The adversary selects and researches a target.
- Weaponization: The adversary prepares a capability or payload for the intended intrusion.
- Delivery: The capability is transmitted or otherwise introduced to the target.
- Exploitation: A vulnerability or another opportunity to execute is used.
- Installation: A foothold or malicious capability is established.
- Command and Control: The adversary communicates with compromised systems.
- Actions on Objectives: The adversary pursues the intended outcome, such as gaining access to information or achieving another operational objective.
These names and their order follow Lockheed Martin’s official overview and application guide.
#1 Best Overall
How does the Cyber Kill Chain help defenders?
Defenders can map observations, detections, and countermeasures to the phases. For each phase, teams can ask what evidence they collect, which protections apply, and whether there is a gap that merits attention. Recording the phase where activity was detected or stopped also helps describe how far an observed intrusion progressed.
Lockheed Martin’s guide frames disruption at any phase as breaking the chain. In practice, that is the framework’s defensive model, not a promise that stopping one observed action will always eliminate an adversary’s access or prevent other routes to an objective. The value is in identifying plausible points for detection and intervention and making gaps visible. Lockheed Martin’s guide to applying the framework with a threat intelligence platform describes associating countermeasures with stages, identifying gaps, and tracking where activity is stopped over time.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How is the Cyber Kill Chain different from MITRE ATT&CK?
The frameworks complement each other, but they answer different questions. The Cyber Kill Chain supplies an ordered, high-level narrative. MITRE ATT&CK describes adversary behavior and techniques in greater detail; its tactics are not a required sequence, and a single intrusion need not include every tactic. MITRE’s official FAQ describes ATT&CK and the Cyber Kill Chain as complementary.
| Comparison | Cyber Kill Chain | MITRE ATT&CK |
|---|---|---|
| Level of detail | High-level phases for structuring an intrusion narrative. | More detailed descriptions of adversary behaviors and techniques. |
| Ordering | Seven phases presented in an ordered sequence. | Tactics are unordered; not every tactic must appear in an intrusion. |
| Useful question | Where might activity fit in an intrusion’s progression, and where could it be interrupted? | Which specific adversary behaviors and techniques should analysts name and investigate? |
In analysis, use the Kill Chain to communicate the broad progression and possible intervention points; use ATT&CK when you need to describe and investigate particular behaviors. Together, they can provide both a simple narrative and a more detailed behavioral vocabulary.
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
