Cyber Kill Chain.

Lockheed Martin's seven-stage model that describes how a targeted intrusion progresses from reconnaissance to actions on objectives. It belongs to the Defense & Operations category of cybersecurity.

Lockheed Martin's seven-stage model that describes how a targeted intrusion progresses from reconnaissance to actions on objectives.

The Cyber Kill Chain, published by Lockheed Martin in 2011, breaks an intrusion into seven sequential phases: reconnaissance, weaponization, delivery, exploitation, installation, command and control, and actions on objectives. The model encourages defenders to detect, deny, disrupt, degrade, deceive, or destroy adversary activity at each step, because breaking any single link prevents the campaign from succeeding. It was one of the first widely adopted threat-centric frameworks and remains useful for mapping defences, prioritizing telemetry, and communicating incident timelines. Critics note it fits classic malware-delivered intrusions better than insider abuse, cloud-native attacks, or low-noise espionage; many teams now combine it with MITRE ATT&CK.

Defences for Cyber Kill Chain typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: Lockheed Martin Kill Chain, Intrusion Kill Chain.