What is the cyber kill chain?

What the kill chain is

The cyber kill chain is a framework for thinking about an attack as a sequence rather than a single event. The term was adapted from a military concept, where a kill chain describes the stages of attacking a target, and applied to cybersecurity by Lockheed Martin to describe the steps an attacker moves through. The central insight is simple but powerful: a successful attack is not one action but a chain of them, and breaking any link in the chain disrupts the whole attack.

This reframes defense in a useful way. Instead of hoping to stop an attack at a single point, usually the perimeter, the kill chain encourages defenders to think about detecting and disrupting the attacker at every stage of their progression. Even if the attacker gets past one defense, there are further stages, and further opportunities, to catch and stop them before they achieve their objective. For ransomware in particular, which unfolds over a long sequence, this stage-by-stage view is exactly how effective defense is organized.

The stages of the kill chain

The classic Lockheed Martin model describes seven stages, and while different frameworks name them slightly differently, the progression maps cleanly onto how a ransomware attack actually unfolds.

• Reconnaissance: the attacker researches the target, identifying people, systems, and weaknesses to exploit.
• Weaponization: they prepare their tools, such as a malicious document or an exploit for a known vulnerability.
• Delivery: they deliver the weapon, often through a phishing email or an exposed service.
• Exploitation: the delivered payload exploits a vulnerability or tricks a user, gaining the initial foothold.
• Installation: the attacker establishes persistent access so they can return at will.
• Command and control: the compromised systems connect back to the attacker, who now directs them remotely.
• Actions on objectives: the attacker achieves their goal, which for ransomware means lateral movement, data theft, and encryption.

Why the kill chain matters for defense

The strategic value of the kill chain is that it turns a single point of failure into many opportunities for defense. A defense built only around prevention bets everything on stopping the attacker at delivery or exploitation, the early stages, and has nothing left if the attacker gets past. A kill-chain mindset recognizes that an attacker who gets a foothold still has to move through installation, command and control, and the long actions-on-objectives phase before they can do real damage, and each of those stages is a chance to detect and disrupt them.

This is especially important for ransomware because its most damaging stage, the actions-on-objectives phase of lateral movement, data theft, and encryption, comes late in the chain and unfolds over an extended period. An attacker may be inside for days or weeks working through these steps, which is a long window in which a defender watching for the behaviors of each stage can intervene. Catching the command-and-control beaconing, the lateral movement, or the data exfiltration, any one of these breaks the chain before encryption, is how an intrusion is stopped short of catastrophe.

The kill chain and modern frameworks

The kill chain is a useful mental model, but it has limitations that newer frameworks address. Its linear, sequential picture does not perfectly capture modern attacks, which can loop, skip stages, or pursue several paths at once, and it was originally oriented toward perimeter intrusion rather than the insider-style movement that dominates ransomware today. For this reason many defenders now also use the MITRE ATT&CK framework, which catalogs the specific tactics and techniques attackers use in far more granular detail, mapping the real behaviors seen in actual incidents rather than a fixed seven-step sequence.

The two are complementary rather than competing. The kill chain provides the high-level story, an attack is a progression you can disrupt at many points, while ATT&CK provides the detailed vocabulary of exactly how attackers operate at each point. For building a defense, the practical takeaway from both is the same and is the foundation of resilience: do not rely on stopping every attack at the door, but build detection and disruption across the whole span of an attack, so that a link can be broken at any stage. A defense that can see and act at multiple points in the chain is one that can stop an attack even when the attacker gets past the first line, which is precisely the realistic goal.

Mapping the kill chain to a ransomware defense

It is worth making the kill chain concrete by mapping defenses onto its stages, because doing so shows why a layered approach works. Against reconnaissance and delivery, the early stages, prevention does the heavy lifting: reducing the attack surface, filtering phishing, hardening internet-facing systems, and enforcing strong authentication all make the attacker's opening moves harder. But because these defenses are not perfect, the kill-chain view insists on also defending the later stages, which is where ransomware does its real damage and where it is most catchable.

Once an attacker has a foothold and moves into installation, command and control, and actions on objectives, a different set of defenses takes over. Behavioral detection watches for the command-and-control beaconing and the lateral movement that these stages produce; network monitoring surfaces the data exfiltration that precedes encryption; deception traps catch the exploration an intruder must do; and automatic containment severs the attack mid-chain by isolating the affected systems. Crucially, each of these is a chance to break the chain before the final, catastrophic encryption. A defender does not need to catch the attacker at every stage, only at one, to stop the attack. This is the strategic gift of the kill-chain model: it reveals that a long ransomware campaign offers many opportunities for interdiction, and a defense designed to act at several of them is far more likely to stop the attack than one betting everything on the perimeter.