Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →The Cyber Kill Chain is Lockheed Martin’s seven-stage framework for describing an intrusion and identifying where defenders may detect or disrupt it. Its phases—Reconnaissance, Weaponization, Delivery, Exploitation, Installation, Command and Control, and Actions on Objectives—provide a shared, high-level map, not a rule that every attack follows the same path.
What is the Cyber Kill Chain?
Lockheed Martin developed the Cyber Kill Chain® as part of its Intelligence Driven Defense model. It organizes an adversary’s activity into an ordered sequence, from researching a target to pursuing an objective. The framework is intended to help defenders understand intrusions and consider ways to prevent them. Lockheed Martin’s overview describes the model and its purpose.
As an Amazon Associate I earn from qualifying purchases.
Use the sequence as a mental map for an intrusion narrative: what may have happened, what activity could follow, and where a control might interrupt it. It is a model, not a claim that all real attacks unfold identically or that every phase will be observed.
What are the seven stages of the Cyber Kill Chain?
Lockheed Martin’s application guide presents the phases in this order. The guide also discusses associating countermeasures with stages.
#1 Best Overall
- Reconnaissance: The adversary selects and researches a target.
- Weaponization: The adversary prepares a capability or payload for the intended intrusion.
- Delivery: That capability is transmitted or otherwise introduced to the target.
- Exploitation: A vulnerability or another opportunity to execute is used.
- Installation: A foothold or malicious capability is established.
- Command and Control: The adversary communicates with compromised systems.
- Actions on Objectives: The adversary pursues the intended outcome, such as accessing information or achieving another operational goal.
How does the Cyber Kill Chain help defenders?
The framework helps teams connect observed activity to possible intervention points. Lockheed Martin’s guide expresses the model’s defensive premise as: “Stopping adversaries at any stage breaks the chain of attack!” That is the framework’s organizing idea, not a guarantee that stopping one observed step will prevent every real-world intrusion.
For practical analysis, map protections and detections to the phases, then ask where visibility or response is missing. A team can use the map to identify which stages have relevant telemetry and controls, note where an intrusion was detected or stopped, and review gaps that may warrant investment. Lockheed Martin’s 2015 application paper describes using a threat intelligence platform to associate countermeasures with stages, surface gaps, and track stopping points over time; this is an example of a software category, not an endorsement of a particular product.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How is the Cyber Kill Chain different from MITRE ATT&CK?
The two frameworks answer related but different questions. MITRE says they are complementary; the distinction is mainly the level of detail and how activity is organized. MITRE’s FAQ explains the relationship and the structure of ATT&CK.
Free tools Windows power users keep installed
One-click scans. No signup required.
| Dimension | Cyber Kill Chain | MITRE ATT&CK |
|---|---|---|
| Level of detail | High-level phases for structuring an intrusion narrative. | More detailed adversary behaviors and techniques. |
| Ordering | Seven phases presented in an ordered sequence. | Tactics are unordered; not every tactic must appear in a given intrusion. |
| Best fit | Discuss the broad progression of activity and possible intervention points. | Name, investigate, and document specific adversary behaviors. |
In practice, use the Kill Chain to orient an investigation around broad stages, then use ATT&CK when you need a more granular vocabulary for behaviors. Neither framework should be mistaken for a complete prediction of how a particular incident will unfold.
Quick Recap
Best Value
Rank #3
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
