SteveisIT — Breaking Down the Cyber Kill Chain

In the field of cybersecurity, one of the most widely-used frameworks for describing the stages of a cyber attack is the Cyber Kill Chain. Developed by Lockheed Martin, it's a simple way to understand how an attack unfolds — and, more importantly, where defenders can step in to stop it.

At a high level, the chain has seven stages. The good news: you don't have to win at every stage. Break the chain at any single link and the attack fails.

The seven stages

Reconnaissance — the attacker gathers intel and looks for weak spots.
Weaponization — they build the payload that exploits what they found.
Delivery — the payload is sent (email, a malicious link, a USB).
Exploitation — the vulnerability is triggered and code runs.
Installation — they establish a foothold to keep access.
Command & Control — the foothold phones home for orders.
Actions on Objectives — the actual goal: theft, encryption, destruction.

"You don't have to be perfect at every stage. You just have to break one link."

Defending each link

Here's the part I drill with my students: every stage has a matching set of defenses. Map your controls to the chain and the gaps become obvious.

Reconnaissance

Limit what's publicly discoverable, segment your network, and train people on what attackers can learn from a casual LinkedIn scroll. A quick way to see your own exposure:

# what does the internet already know about you?
whois yourdomain.com
nslookup yourdomain.com
theHarvester -d yourdomain.com -b all

Delivery & exploitation

This is where most real-world attacks actually land — usually through email. Email filtering, patching, and a little healthy skepticism cover most of it. In class I prove the point by sending a (harmless) phishing test; the click rate is always a wake-up call.

Field noteThe single highest-ROI defense for most small teams isn't a fancy tool — it's patching known vulnerabilities and turning on multi-factor authentication. Boring, unglamorous, devastatingly effective.

Putting it to work

Run your last incident — or a hypothetical one — through the chain. At which link could you have stopped it? That question, asked honestly, is worth more than most security audits.

Want the hands-on version? My penetration testing course walks the chain from both sides — attacking and defending — using real-world vulnerabilities.