What Is the Cyber Kill Chain? 7 Stages Explained

Key Takeaways

1. Cyber Kill Chain is a cybersecurity framework developed by Lockheed Martin that explains how targeted cyberattacks move from early reconnaissance to the attacker's final objective.
2. Security teams use the cyber kill chain to understand attacker behavior and identify points where intrusions can be detected or stopped before real damage occurs.
3. Attack activity moving through reconnaissance, weaponization, delivery, exploitation, installation, command and control, and actions on objectives reveals how complex threats unfold step by step.
4. Advanced Persistent Threats (APTs) become easier to detect and contain when cyber kill chain insights are applied alongside modern monitoring and response capabilities.

The cyber kill chain is a framework that breaks a targeted cyberattack into seven sequential stages, from early reconnaissance through to the attacker achieving their objective. It helps defenders identify and stop threats. 

Lockheed Martin researchers Eric Hutchins, Michael Cloppert, and Rohan Amin introduced it in a 2011 paper, adapting a military targeting concept to network defense on the argument that advanced attackers follow repeatable patterns worth studying.

Evidence for that repeatability turns up whenever an operator leaves their working directory exposed. CloudSEK researchers recovered a timestamped, command-level record of a Russian-speaking initial access broker covering mid-2025 into late 2026, showing the same operator exploiting internet-facing appliances across more than a dozen countries, staging exploits for at least twelve CVEs, harvesting credentials, achieving full Active Directory compromise, and then selling that access on. Each of those actions maps to a stage, and the sequence held across victims in education, healthcare, finance, telecommunications, and government.

How the Cyber Kill Chain Works

Cyber Kill Chain works by viewing an attack as something that unfolds through intention and preparation, not as a sudden technical failure. An attacker moves forward only when earlier actions succeed, which creates a dependency between steps.

Security teams observing one part of an intrusion can often infer what the attacker has already done and what is likely to happen next. That visibility comes from understanding how attacker decisions build on one another over time.

Cyber Kill Chain provides a structured way to read that progression, turning scattered signals into a clear sense of direction. Instead of reacting to individual alerts, defenders gain context about where an attack stands and how close it is to causing harm.

Seven Stages of the Cyber Kill Chain

Each stage below describes a distinct attacker objective, with its own observable signals and its own opportunities for interruption.

1. Reconnaissance

Gathering information about a target before any direct contact occurs is where a targeted attack begins. Attackers profile employees through public sources, enumerate exposed services and subdomains, harvest technical details from WHOIS records and job listings, and scan internet-facing infrastructure to map what exists. Most successful intrusions involve cybersecurity reconnaissance activity days or weeks before access is attempted, and the quality of that groundwork determines how targeted everything after it can be.

2. Weaponization

Converting gathered intelligence into a deliverable payload happens entirely on attacker infrastructure, which makes this the stage defenders observe least. Malicious documents, exploit-laden files, and packaged malware are assembled to fit the target environment and evade the specific defenses reconnaissance identified. Weaponization increasingly means adapting a public proof-of-concept rather than writing an original exploit, which is precisely what the access broker in CloudSEK’s investigation did across twelve CVEs.

3. Delivery

Transmission of the weaponized payload to the target marks the first point at which defenders can observe the attack directly. Email remains the dominant channel, though compromised websites, malicious advertising, removable media, and exploitation of internet-facing services all serve the same function. Targeted campaigns favor spear phishing over volume, and the wider set of phishing techniques covers how those messages are constructed to survive filtering.

4. Exploitation

Triggering a vulnerability to execute attacker code turns delivery into access. Software flaws, misconfigurations, and user interaction all serve as the trigger, and unpatched internet-facing systems remain the most reliable route because they require no human error at the victim end. Exploitation is brief, which makes detection here dependent on behavioral monitoring rather than on catching the payload in transit.

5. Installation

Establishing persistence ensures access survives reboots, credential changes, and routine cleanup. Web shells, scheduled tasks, registry modifications, service creation, and remote access tooling all serve this purpose, and attackers install several mechanisms as a matter of routine so that removing one leaves the others intact. Harvested leaked credentials also serve as persistence, since a valid login requires no malware to persist.

6. Command and Control

Establishing a communication channel back to attacker infrastructure gives an operator interactive control over the compromised environment. Frameworks such as Sliver and Cobalt Strike provide that channel, and traffic is routinely disguised as HTTPS, DNS queries, or legitimate cloud service calls to blend with normal activity. Beaconing patterns and unexpected outbound destinations are the signals defenders watch for at this stage.

7. Actions on Objectives

Everything preceding it exists to enable the execution of the attacker’s actual goal. Data theft, encryption for extortion, espionage collection, lateral movement toward higher-value systems, and destruction all fall here. SolarWinds remains the widely cited example of an operation reaching its objective while producing minimal detectable activity earlier in the chain, which is a property of supply chain attacks as a class.

Is There an Eighth Stage? The Monetization Debate

Practitioners have argued for years that the original seven stages stop short of where financially motivated attacks actually end. Converting access or stolen data into money is a distinct operation with its own infrastructure, its own participants, and its own timeline, which is the case for treating monetization as a stage rather than an afterthought.

The access broker investigation described earlier illustrates that argument concretely rather than theoretically. That operator did not encrypt anything or exfiltrate for personal use; the business model was reaching Active Directory compromise and then selling it, and ransomware groups claimed several of the same organizations within weeks of the access being obtained. Two separate actors completed one chain between them, which the original seven-stage model has no way to represent. Ransomware-as-a-service economics depend on exactly this division of labor.

Formal adoption of an eighth stage matters less than recognizing the phase exists. Security and legal teams preparing for extortion demands, data-leak threats, and negotiation are planning for activity that falls outside technical containment entirely, and a model that ends at actions on objectives gives them no place to put it.

Cyber Kill Chain vs. MITRE ATT&CK

Comparisons between the two frameworks tend to frame them as competitors, when they answer different questions and are most useful together.

Programs with any maturity run both frameworks rather than choosing between them. The kill chain supplies the narrative arc that makes an intrusion explicable to an executive audience, while the MITRE ATT&CK framework supplies the technique-level detail that detection rules are built from. Mapping observed tactics, techniques, and procedures onto kill chain stages gives analysts both the position and the specifics at once.

Unified Kill Chain and Other Extensions

Dissatisfaction with the linear structure produced extensions to the model rather than replacements for it. Paul Pols published the Unified Kill Chain in 2017, merging the Lockheed Martin model with MITRE ATT&CK into eighteen phases grouped under three headings: Initial Foothold, Network Propagation, and Action on Objectives.

The substantive change is recognizing that attacks loop back on themselves rather than advancing cleanly. An attacker who gains a foothold, moves laterally, and then repeats reconnaissance inside the new environment is doing something the seven-stage model cannot express, and the Unified Kill Chain represents that iteration explicitly. Organizations wanting lifecycle clarity without losing visibility into attacks that skip, repeat, or parallelize stages tend to land on this model or something similar.

Limitations of the Cyber Kill Chain

Understanding where the model breaks down matters as much as understanding what it describes, because applying it too literally produces blind spots.

• Linear sequencing assumes an order attackers do not follow. Real intrusions skip stages, repeat them, and run several in parallel, and an operator using stolen credentials against an exposed service compresses reconnaissance through installation into minutes.
• Perimeter framing underserves insider and identity attacks. An employee misusing legitimate access performs no delivery and no exploitation, so the model has nowhere to place the activity.
• Cloud-native attacks fit awkwardly. Compromise of an over-permissioned identity or a misconfigured storage bucket involves no malware installation and no traditional command-and-control channel.
• Behavioral depth is shallow by design. Stages describe intent rather than technique, which is why detection engineering needs a complementary framework rather than this one alone.
• Early stages are the hardest to observe. Reconnaissance and weaponization occur largely outside the defended environment, so the stages offering the most defensive value are the ones producing the fewest internal signals.

External monitoring addresses that last constraint more directly than any internal control does. Reconnaissance against internet-facing assets is visible from outside even when it produces nothing internally, which is why external attack surface management contributes to the stages where internal telemetry is weakest.

How Security Teams Apply the Cyber Kill Chain

Practical use of the model concentrates in four areas, each of which turns stage awareness into a decision rather than a description.

• Alert triage and prioritization. Placing an alert at a stage establishes urgency, since command-and-control beaconing demands a faster response than a scanning attempt against a hardened edge device.
• Control coverage assessment. Mapping each control to the stage it interrupts exposes gaps, and most organizations discover their coverage clusters heavily in the later stages.
• Incident response sequencing. Knowing how far an intrusion progressed determines whether the priority is containment, eradication, or forensic scoping.
• Red team and tabletop design. Exercises built around stage progression produce more realistic scenarios than those testing isolated techniques.

Control mapping is where the framework earns its keep in practice.

Laying controls out against stages this way makes coverage gaps obvious immediately. Teams that map their stack against these rows find the first two rows close to empty, because reconnaissance and weaponization happen where internal tooling cannot reach. Establishing which of those exposures are genuinely reachable is the work of a security threat assessment, and operationalizing the intelligence behind it is covered under SOC best practices.

Disrupting the Chain Before Execution with CloudSEK Nexus AI

Value in this model concentrates at the stages preceding compromise, and those are the stages internal tooling covers least. CloudSEK Nexus AI correlates signals from digital risk, the external attack surface, AI systems, and third-party ecosystems into a validated attack path, then identifies which single fix breaks the chain earliest.

Setting expectations correctly here matters as much as the capability itself. CloudSEK operates at the reconnaissance and initial-access stages rather than functioning as an incident response service, a managed security service, or an endpoint monitoring tool. 

Original research is what gives that early-stage view its specificity. Reconstructing the access broker’s operation from an exposed directory produced the CVEs being staged, the appliances being targeted, and the ransomware groups buying the resulting access, which is intelligence that lands before those groups reach any of their next victims. Delivering it into existing workflows is what a threat intelligence platform handles, and defending against advanced persistent threats depends on that early warning more than on any single control.

Frequently Asked Questions

Who created the cyber kill chain?

Lockheed Martin researchers Eric Hutchins, Michael Cloppert, and Rohan Amin, in a 2011 paper adapting the military kill chain concept to network defense.

Is monetization an official stage of the cyber kill chain?

No. The original Lockheed Martin model defines seven stages. Monetization is a widely used addition describing how attackers convert access or stolen data into revenue.

Does the cyber kill chain apply to insider threats?

Poorly. An insider with legitimate access performs no delivery or exploitation, so most stages have nothing to describe. Behavioral frameworks handle these cases better.

What is the difference between the cyber kill chain and the unified kill chain?

The unified kill chain extends seven stages to eighteen across three phases, and it represents attacks as iterative loops rather than as a single ordered sequence.

Which kill chain stage is hardest to detect?

Weaponization. It occurs entirely on attacker infrastructure, producing no signal inside the defended environment until the payload is delivered.

Can the cyber kill chain be used for cloud environments?

As a conceptual guide, yes. Cloud-native attacks involving identity abuse or misconfiguration skip installation and command-and-control stages altogether.

Is the cyber kill chain still relevant?

Yes, as a strategic model rather than a detection mechanism. Preparation, access, control, and execution still occur, even where attackers compress or reorder them.

Final Thought: Using the Kill Chain as a Model Rather Than a Checklist

Criticism of the cyber kill chain is largely a criticism of how literally people apply it. Treating seven stages as a sequence every intrusion must follow produces detection logic that misses anything moving out of order, which describes most modern attacks and nearly all cloud and identity-driven ones.

Treated as a way of thinking about intent and progression, the framework holds up better than its age suggests. Attackers still prepare before they act, still need access before control, and still need control before achieving anything, and the access broker CloudSEK documented followed that arc across dozens of victims over eighteen months. What changed is the speed and the division of labor, not the logic, and defenders who map their coverage against progression rather than against isolated indicators find the gaps that matter earliest.