How Attackers Think: A Beginner's Tour of the Cyber Kill Chain

so you want to understand how a hack actually happens, not the hollywood version with the green scrolling text. good news: the people who defend networks for a living already have a map for it, and it has been around longer than most of the apps on your phone.

it is called the cyber kill chain, and once you see it you cannot unsee it. this post walks through all seven stages in plain english, with what the attacker is trying to do at each one and where a defender gets to slam the door. no tools to buy, no degree required. just the mental model.

Where the cyber kill chain comes from

the cyber kill chain was built by Lockheed Martin as part of what they call their Intelligence Driven Defense model. their own description is refreshingly blunt: the model "identifies what the adversaries must complete in order to achieve their objective." in other words, an attacker cannot skip to the good part. they have to walk through a sequence, and every step is a chance for you to notice and stop them.

Lockheed Martin lists seven steps, and says the point of breaking an attack into stages is to "enhance visibility into an attack and enrich an analyst's understanding of an adversary's tactics, techniques and procedures." that is the whole game: see the attack earlier, in more detail, so you can act before the last step. you can read it on the Lockheed Martin cyber kill chain page.

one more map worth knowing: MITRE ATT&CK. it calls itself "a globally-accessible knowledge base of adversary tactics and techniques based on real-world observations", and it is open and free to anyone. the kill chain gives you the shape of an attack. ATT&CK fills in the specific moves attackers actually use at each stage. start with the kill chain for the story, then dig into ATT&CK when you want the details.

The seven stages, one at a time

here they are, in order. an attacker generally has to clear each one to reach the next.

1. Reconnaissance

the attacker picks a target and learns everything they can without touching anything. who works there, what tech the company runs, which email addresses are easy to guess, what got posted on LinkedIn last week. most of this is public. none of it trips an alarm.

what you can do: assume the information is out there and plan around it. the less a random stranger can learn about your internal setup, the harder this stage gets.

2. Weaponization

now the attacker builds the thing they will send you. a malicious document, a booby-trapped installer, a link that leads somewhere bad. this happens on their side, so you will never see it directly. you only meet its output in the next stage.

3. Delivery

the payload has to reach you somehow. email is the classic: a convincing message with an attachment or a link. it could also be a usb stick in the parking lot, a compromised website, or a message on a platform your team trusts.

what you can do: this is the first stage you can actually block. email filtering, a trained team that hovers before clicking, and a healthy suspicion of "urgent" attachments all live here.

4. Exploitation

the payload runs and takes advantage of a weakness. an unpatched bug, a setting left open, or just a person who clicked and typed their password into a fake page. the attacker gets their first real foothold.

what you can do: patch the loud stuff promptly, and give people a safe, blameless way to say "i think i clicked something." speed matters more than shame.

5. Installation

the attacker makes their foothold stick. they install something that survives a reboot, so they still have access tomorrow even if you close the window they came in through. this is the difference between a visitor and a squatter.

what you can do: watch for new programs and services appearing where they should not, especially on machines that rarely change.

6. Command and control

the installed thing phones home. it opens a quiet channel back to the attacker so they can send instructions and pull data. the whole point of mapping these stages is visibility, and command and control traffic is often where a careful defender first spots that something is wrong.

what you can do: know what normal outbound traffic looks like for your systems, so the abnormal stuff stands out.

7. Actions on objectives

finally, the attacker does the thing they came for. steal data, encrypt everything for ransom, quietly sit and watch. everything before this was setup. this is the payoff, and by now they have earned a lot of room to move.

The one idea that changes how you defend

here is the part that makes the kill chain more than a list. you do not have to be perfect at every stage. you have to break the chain at any one of them.

an attacker who gets past reconnaissance, weaponization and delivery, but gets caught at exploitation, has still failed. that is a comforting thought when "stop every attack" feels impossible. you are not trying to be a wall. you are trying to be a series of trip wires, so that one of them catches what the others missed.

this is also why the perimeter-only mindset ages badly. if your entire defense is "keep them out," then one slip at delivery hands the attacker the whole building. stack your defenses across stages instead, and a single failure stops being fatal. if you want the grown-up version of this idea for a company network, our post on zero trust architecture picks up exactly where this leaves off.

Where to go if you want to go deeper

if this clicked and you want more, two moves:

• read the framework in the original. Lockheed Martin's cyber kill chain page is short and sets the vocabulary straight.

• then open MITRE ATT&CK and pick one tactic. it maps real attacker techniques to stages, with real-world examples, and it is free. it is the closest thing the field has to a shared language for "here is exactly how they did it."

you do not need a lab or a certification to start thinking like a defender. you need the map. now you have it: seven stages, and a door you get to shut at each one.