Glossary

(Cyber) Kill Chain

What is a (cyber) kill chain?

The kill chain is an IT security concept that describes the typical course of a cyber attack in several successive phases. The aim of this model is to better understand and analyze the attack and to interrupt it at specific points in order to prevent greater damage.

The term originally comes from the military sector. In cyber security, it became known through the so-called Cyber Kill Chain model developed by Lockheed Martin. This breaks down an attack into seven classic phases: Reconnaissance, weapons development, dissemination, delivery, exploitation, installation, command and control, and target achievement (for example, data theft or sabotage).

By understanding which phase of the kill chain an attack is in, security teams can derive appropriate countermeasures, such as blocking suspicious activity early, shutting down compromised access points or deploying targeted IOCs.

Today, the kill chain is a central component of modern security strategies. It helps to analyse attacks in a structured manner, better classify threats and effectively prioritize defensive measures.

 

A chart outlines the seven Cyber Kill Chain phases: Reconnaissance, Weaponization, Delivery, Exploitation, Installation, Command & Control, and Actions on Objective—each with brief descriptions.