How the Cyber Kill Chain works
The model walks through an intrusion in order. The attacker researches the target, prepares a malicious payload, delivers it by email or a website, exploits a weakness, installs a foothold, establishes remote control, and finally acts to steal, destroy, or disrupt.
The central idea is that breaking any link can stop the attack. A defender can detect, deny, disrupt, degrade, or deceive at each stage. Critics note that the model is linear and focuses on the perimeter, so many teams pair it with MITRE ATT&CK for finer detail on post-compromise behaviour.
Why it matters for Canadian organizations
The framework gives security teams and executives a shared way to discuss how attacks unfold and where investments reduce risk. It helps explain why email filtering, patching, and network monitoring each matter, since they target different stages.
It is useful when writing incident reports for regulators, insurers, and boards, because events can be mapped to stages clearly. Organizations working with the Canadian Centre for Cyber Security guidance or building controls for ISO 27001 and OSFI B-13 often use it to check coverage across the attack lifecycle.
How to implement it
Map your current controls to each stage and look for stages with weak coverage. For example, security awareness and email filtering address delivery, patching addresses exploitation, and egress filtering and DNS monitoring address command and control.
Use the map to guide detection engineering and tabletop exercises. Prioritize early-stage disruption where possible, since stopping an attack before installation is cheaper than evicting it later. Combine with ATT&CK to cover techniques used after the initial intrusion, including lateral movement. Revisit the mapping after each incident or exercise.
Frequently asked questions
What are the seven steps of the Cyber Kill Chain?
They are reconnaissance, weaponization, delivery, exploitation, installation, command and control, and actions on objectives. The sequence describes how many targeted attacks progress from initial research to the final goal. Together they provide both the big picture and detailed technique-level coverage.
Is the Cyber Kill Chain the same as MITRE ATT&CK?
No. The kill chain is a high-level, seven-stage model, while MITRE ATT&CK is a detailed catalogue of adversary tactics and techniques. They complement each other, and many teams use both. Treat it as a communication aid rather than a complete model of attacker behaviour.
What are the limitations of the Cyber Kill Chain?
It assumes a mostly linear attack from outside and says less about insider threats, stolen credentials, and activity after initial access. For this reason it is best used alongside more detailed frameworks. Pairing it with ATT&CK covers credential theft, lateral movement, and insider activity.
Related service: Cyber defense services