Cyber kill chain
In offensive security, the cyber kill chain is a model that breaks an intrusion into ordered stages, from reconnaissance through to actions on the objective. Introduced by Lockheed Martin, it is a planning and defence aid, and it is routinely confused with MITRE ATT&CK, which is a different kind of model.
How it works
The kill chain describes an intrusion as a sequence: reconnaissance, weaponisation, delivery, exploitation, installation, command and control, and actions on objectives. The defensive idea is that breaking any one link stops the whole operation, so a defender can plan controls stage by stage rather than react to the final impact. It is deliberately linear and high level, which makes it a good way to explain an attack to a non-technical audience and to reason about where prevention is cheapest.
The confusion with MITRE ATT&CK is worth clearing up. The kill chain is a small, ordered narrative of a whole attack. ATT&CK is a large matrix of tactics and techniques, mostly describing what an intruder does after they already have a foothold, with no fixed order. One tells the story; the other catalogues the moves.
What goes wrong
The model’s weakness is where teams over-trust its shape. Real intrusions are not tidy chains. An attacker loops back, moves sideways, and skips stages: lateral movement and persistence happen repeatedly, not once, and an advanced persistent threat may sit installed for a long time before acting. Planning defence as if each link occurs once, in order, leaves gaps precisely where a capable adversary operates: in the messy post-compromise middle. Treating the diagram as reality, rather than as a teaching aid, is the mistake.
Where this shows up in an audit
When we present an intrusion to a client, the kill chain is often the frame for the executive summary and ATT&CK is the frame for the technical detail: the story on one page, the technique-by-technique evidence behind it. We use it to show which links their controls could have broken and at what cost. This is part of how we map an intrusion for the client so both the board and the blue team read the same event at the right level.