What Is Cyber Kill Chain?

The cyber kill chain describes an intrusion as a sequence of stages an adversary must complete: reconnaissance, weaponisation, delivery, exploitation, installation, command and control, and actions on the objective.

Its enduring value is the argument it makes rather than the accuracy of the sequence — that an attack requires many successful steps, and defenders only need to break one.

What the model is good for

Communicating with non-specialists, because a linear narrative is graspable in a way a technique matrix is not. It makes the case for defence in depth concrete: controls at several stages mean an adversary succeeding at one is still stopped.

It is also useful for structuring a post-incident narrative — walking an executive audience through how an intrusion progressed, stage by stage, and where it could have been interrupted.

Where it does not describe reality

Real intrusions are not linear. Adversaries loop, move laterally and repeat earlier stages against new targets, so a single pass through seven stages describes almost no actual incident.

It is also weighted toward malware delivery, which reflects when it was devised. An intrusion that begins with valid stolen credentials skips most of the early stages entirely, and that is now among the most common routes.

Insider and identity-based activity fit poorly

An employee misusing access they legitimately hold performs no reconnaissance, delivers nothing and exploits nothing. The model has no place to put them.

The same applies to an adversary using a valid session token, which is why identity-centric models have displaced it for detection design even where it survives for explanation.

How it relates to the technique matrix

MITRE ATT&CK largely replaced it for operational use because it catalogues specific observed techniques rather than abstract stages, which maps directly onto detections and controls.

The chain survives because it answers a different question. Explaining to a board how an intrusion unfolded is a narrative task, and a matrix of hundreds of techniques does not serve it.

Using it without being misled

Treat the stages as categories of opportunity rather than a sequence. Ask what controls and detections exist for each category, and accept that an adversary may enter partway through, skip stages or revisit them.

The defensive conclusion holds regardless of the sequence's accuracy: coverage across several categories is more robust than excellent coverage of one.

Later variants, and whether they help

Extended models exist that add stages for reconnaissance conducted outside the target, for lateral movement, and for the internal phases the original compressed into one step. They describe modern intrusions more accurately and they lose the brevity that made the original useful for explanation.

That trade is worth being explicit about. If the purpose is communicating with a non-technical audience, the simpler model serves better; if the purpose is operational analysis, a technique catalogue serves better than any staged model.

Where to start

Use it where it is strong: the next time you explain an incident to a non-technical audience, walk the stages and name where it could have been interrupted. Use the technique matrix for anything involving actual coverage.

See MITRE ATT&CK. GuardsArm runs security risk assessments.