What is the cyber kill chain?
Definition
The cyber kill chain is a seven-stage model of the steps an attacker has to complete to break into a network and reach their goal, developed by Lockheed Martin to help defenders spot and stop an intrusion early.
- Category
- Security
- Also called
- kill chain, Lockheed Martin kill chain
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
Sources checked: lockheedmartin.com
Last verified against the official page:
The cyber kill chain comes from Lockheed Martin, which built it as part of its Intelligence Driven Defense model. The idea is simple: an intrusion is not one event but a sequence, and the attacker has to get through every step. If a defender breaks the chain at any point, the attack fails.
The seven stages
- Reconnaissance. The attacker researches and picks a target, for example by collecting email addresses from websites and mailing lists.
- Weaponization. They prepare the tool, such as a malicious file or a backdoor, and the infrastructure it will talk to.
- Delivery. The tool reaches the target, often as an email attachment or a malicious link.
- Exploitation. The attacker uses a vulnerability, or a person opening the file, to get code running.
- Installation. They plant a persistent backdoor so they keep access.
- Command and control. The infected machine connects back to the attacker, who now has hands on the keyboard.
- Actions on objectives. The attacker does what they came for, typically stealing data, or moving on to other systems.
A concrete example
An attacker finds an employee's work email and job title on a company website (reconnaissance), sends a fake invoice with a booby-trapped attachment (weaponization and delivery), the employee opens it (exploitation), and malware installs and phones home (installation and command and control). Later the attacker copies customer records (actions on objectives).
Why it matters to you
The first stage runs on information about people. The more of your name, email, phone number and job details are publicly listed, the easier it is to craft a believable message to you. Most ordinary people are not the final target, but they are often the delivery route.
Kill chain vs. related terms
The kill chain describes an attack from the attacker's side, in order. A data breach is one possible outcome of the last stage. Social engineering is a technique used mostly in the delivery and exploitation stages. The model is one framework among several, and it fits some attacks better than others.
How to protect yourself
- 1
Treat unexpected attachments and links with suspicion
Delivery is the stage you meet most often. If a message you weren't expecting asks you to open a file or click a link, confirm with the sender through a channel you already trust before you do.
- 2
Keep software and devices updated
Exploitation relies on known flaws. Installing updates when they're offered closes many of them.
- 3
Turn on two-step verification
If a password is stolen, a second factor can stop the attacker getting further into your accounts.
- 4
Shrink what attackers can research about you
Reconnaissance uses public listings. Serus finds where your address, phone number and email are listed and removes them, which makes targeted messages harder to write.
See where your personal data is exposed
Serus finds it on data brokers and people-search sites and removes it.
Frequently asked
Who created the cyber kill chain?
Lockheed Martin developed it as part of its Intelligence Driven Defense model for identifying and preventing cyber intrusions.
How many stages does the cyber kill chain have?
Seven: reconnaissance, weaponization, delivery, exploitation, installation, command and control, and actions on objectives.
Is the cyber kill chain the only attack framework?
No. It is one model among several, and defenders often use it alongside other frameworks. It was designed around intrusions into networks, so it fits some attacks, such as simple phishing for passwords, less neatly.
Sources
Something wrong or out of date? Tell us and we'll re-check it.