Overview
Direct Answer
The Cyber Kill Chain is a linear model that segments cyberattacks into seven distinct phases, from initial reconnaissance through data exfiltration and actions on objectives. It provides a structured framework for analysing adversary behaviour and identifying intervention points before an attack succeeds.
How It Works
The model progresses through reconnaissance (gathering target intelligence), weaponisation (creating malicious payloads), delivery (transmitting exploits), exploitation (executing code on systems), installation (establishing persistence), command and control (maintaining access), and finally actions on objectives (achieving attacker goals). Each phase represents an opportunity where defensive controls can detect and disrupt the attack sequence before advancing to subsequent stages.
Why It Matters
Organisations use this framework to map their defensive capabilities against each phase, prioritising resources where gaps exist. Understanding the chain enables security teams to anticipate adversary progression, allocate monitoring efforts effectively, and design layered defences rather than relying on single-point preventative measures.
Common Applications
Incident response teams employ the model to reconstruct attack timelines and identify missed detection opportunities. Threat intelligence analysts use it to profile adversary tactics and techniques, whilst security architects reference it when designing network segmentation and logging strategies across enterprise environments.
Key Considerations
The linear seven-phase model can oversimplify complex, iterative attacks where adversaries loop back to earlier stages. Modern attacks frequently diverge from this sequence, and the framework does not account for supply chain compromises or insider threats that bypass initial reconnaissance phases entirely.
More in Cybersecurity
Threat Hunting
Defensive SecurityThe proactive search for cyber threats within an organisation's environment that have evaded automated detection, using hypotheses, threat intelligence, and advanced analytics.
Cyber Threat Intelligence
Offensive SecurityEvidence-based knowledge about adversary capabilities, infrastructure, motives, and tactics that informs security decisions and enables proactive defence against cyber attacks.
Security by Design
Security GovernanceAn approach that integrates security considerations into every stage of the software development lifecycle.
Adversary Simulation
Offensive SecurityAdvanced red team exercises that replicate the tactics, techniques, and procedures of specific threat actors to evaluate an organisation's detection and response capabilities.
Supply Chain Attack
Offensive SecurityA cyberattack targeting the less-secure elements of a supply chain to compromise a primary target.
Firewall
Network SecurityA network security device that monitors and filters incoming and outgoing network traffic based on security rules.
Attack Vector
Offensive SecurityThe specific path, method, or scenario used by an attacker to gain unauthorised access to a system.
SQL Injection
Offensive SecurityA code injection technique that exploits vulnerabilities in database-driven applications through malicious SQL statements.