What is the Cyber Kill Chain?
Last updated: April 16, 2026
Definition
The Cyber Kill Chain is a cybersecurity framework that breaks down a cyberattack into seven sequential stages to help security teams identify and disrupt threats before they achieve their objectives. Developed by Lockheed Martin in 2011, the model describes how adversaries conduct attacks from initial reconnaissance through final objectives, enabling defenders to map detection tools and response capabilities to specific attack phases. Security teams use it to analyze Advanced Persistent Threats (APTs), align security tools across the attack lifecycle, and communicate threat progression to stakeholders.
Key Facts
- Also known as: Lockheed Martin Cyber Kill Chain, Kill Chain Framework
- Category: Cybersecurity
- Related standards/protocols: Developed by Lockheed Martin (2011), integrates with MITRE ATT&CK framework
- First defined: 2011 by Lockheed Martin, adapted from military kill chain concepts
How the Cyber Kill Chain Works
The framework models an attack as seven sequential phases. Reconnaissance begins when attackers gather information about the target using open-source intelligence (OSINT), network scanning, and vulnerability probing to identify entry points. Weaponization follows, where attackers create or modify malicious payloads (malware, ransomware, weaponized documents) tailored to exploit the identified weaknesses. Delivery transmits the payload to the target via phishing emails, compromised websites, infected attachments, or by exploiting software and hardware vulnerabilities. Exploitation executes the malicious code by leveraging application vulnerabilities, weak configurations, or human errors to gain system access.
Installation establishes persistence through backdoors, rootkits, Trojans, and access token manipulation, ensuring the attacker maintains ongoing access even after system reboots or remediation attempts. Command and Control (C2) establishes remote communication channels between the attacker and compromised systems using obfuscation techniques to avoid detection while enabling lateral movement across the network. Actions on Objectives executes the attacker's final goal, whether data exfiltration, ransomware encryption, data destruction, or supply chain compromise. Organizations working with managed security partners apply the framework to align their defensive controls across all attack stages.
Why the Cyber Kill Chain Matters
Without a structured attack lifecycle model, security teams respond to breaches after objectives are achieved rather than disrupting them mid-progression. The kill chain enables defenders to map security information and event management tools and other defensive technologies to each attack phase, creating layered defenses. The average eCrime breakout time fell to just 29 minutes in 2025, demonstrating how quickly modern adversaries move from initial access to lateral movement (CrowdStrike, 2026), but the model still provides shared language for threat analysis across security teams.
For solo IT professionals, the framework translates complex attack patterns into a structured methodology for evaluating tool coverage and identifying defensive gaps where limited budgets have the most impact.
Cyber Kill Chain vs. MITRE ATT&CK
| Aspect | Cyber Kill Chain | MITRE ATT&CK |
| Primary function | Models attack as 7 sequential stages | Maps tactics and techniques in a matrix |
| Scope | Perimeter-focused, malware-centric attacks | Comprehensive coverage of attack methods |
| Used by | SOC teams, threat analysts, MSPs | Security engineers, threat hunters, IR teams |
| Key difference | Linear progression assumption | Non-linear, granular real-world tactics |
| When to use | High-level attack lifecycle communication | Detailed threat modeling and detection engineering |
The Cyber Kill Chain provides a linear seven-stage model focused on perimeter-based attacks, while MITRE ATT&CK offers a non-linear matrix of tactics and techniques based on real-world adversary behavior with more granular coverage.
Common Misconceptions
The Cyber Kill Chain is not effective against all attack types. The framework focuses on perimeter security and malware delivery, making it less effective against insider threats, credential-based attacks, and web exploits like XSS or SQL injection.
The Cyber Kill Chain does not assume attackers follow all seven stages sequentially. Modern attacks frequently skip or combine stages, with the fastest observed breakout occurring in only 27 seconds, demonstrating the framework's limitations against fast-moving adversaries.
Frequently Asked Questions
The seven stages are reconnaissance, weaponization, delivery, exploitation, installation, command and control, and actions on objectives. Organizations deploy threat intelligence for reconnaissance, IAM for exploitation prevention, SIEM for C2 detection, endpoint detection capabilities across all stages, and DLP for objective blocking.
The framework assumes linear progression and perimeter-focused security, making it less effective against insider threats and web exploits. MITRE ATT&CK provides non-linear, real-world tactics, while the Unified Kill Chain combines both frameworks into 18 stages for comprehensive coverage.
The 2011 framework struggles with cloud computing, remote work, and IoT because these eliminated the single network perimeter the model assumed. Organizations now use unified security platforms combining XDR and SIEM to defend across all stages in distributed environments.
