Cyber Kill Chain.

The Cyber Kill Chain, introduced by Lockheed Martin analysts Hutchins, Cloppert, and Amin in their 2011 paper Intelligence-Driven Computer Network Defense, breaks an intrusion into seven sequential phases: reconnaissance, weaponization, delivery, exploitation, installation, command and control (C2), and actions on objectives. Its core premise is that an attacker must complete every link, so a defender who detects, denies, disrupts, degrades, deceives, or destroys activity at any single stage breaks the whole campaign — the six "courses of action" applied against each phase form the model's action matrix.

The framework grew out of Lockheed defending against advanced persistent threats and remains useful for structuring telemetry, mapping controls (email filtering at delivery, EDR at installation, egress inspection at C2), and communicating incident timelines to non-technical stakeholders. Its weaknesses are well documented: it is perimeter- and malware-centric, assumes a linear flow, and models insider abuse, credential-only cloud attacks, and living-off-the-land intrusions poorly. Teams increasingly pair it with MITRE ATT&CK for technique-level granularity, the Diamond Model for adversary analysis, and Paul Pols' 18-phase Unified Kill Chain (2017), which merges kill-chain thinking with ATT&CK to cover the full attack lifecycle including lateral movement.

flowchart LR
  A[Reconnaissance] --> B[Weaponization]
  B --> C[Delivery]
  C --> D[Exploitation]
  D --> E[Installation]
  E --> F[Command & Control]
  F --> G[Actions on Objectives]
  G -. break any link .-> H{{Campaign fails}}