Lockheed Martin Cyber Kill Chain

What the Kill Chain Model Explains

The Lockheed Martin cyber kill chain is a way to describe intrusion progression as a sequence of attacker phases. It helps defenders reason about where an intrusion can be interrupted, which signals matter at each stage, and why a single control rarely stops a determined campaign end to end.

The model is especially useful because it shifts attention from isolated alerts to the full attack path. A reconnaissance event, a delivery attempt, or a command channel can each mean more when viewed as part of a larger operational sequence rather than as a standalone incident.

Why the Kill Chain Matters for Defence Planning

For practitioners, the value is not the labels themselves but the discipline of mapping controls and detections to each phase. That makes it easier to identify where preventive controls, hardening, segmentation, detection, or response coverage is thin.

The model also reinforces that attacks are iterative. If defenders only monitor final-stage behaviour, they may miss earlier opportunities to disrupt the intrusion before payload execution, persistence, or objective completion.

Used well, the kill chain supports common defensive questions: where can reconnaissance be spotted, what delivery paths are exposed, which systems can be hardened against exploitation, and where do identity or access controls reduce the blast radius after entry.

How It Relates to Other Intrusion Analysis Models

The kill chain is often paired with other analytic models because it is linear and attacker-centric. That makes it good for explanation and control mapping, but less complete when defenders need to capture branching behaviour, repeated actions, or relationships between infrastructure, victims, and artefacts.

Many teams therefore use it alongside broader threat-intelligence and adversary-behaviour references. A useful example is the Cyber Kill Chain and Diamond Model Guide, which shows how phase-based analysis can be combined with pivoting, courses of action, and ATT&CK mapping.

For operational intelligence work, the kill chain also fits naturally inside a wider threat-intelligence lifecycle. The Threat Intelligence Guide is useful when readers need to connect intrusion stages to collection, analysis, dissemination, and action.

Where the Model Helps Most in Real Environments

The model is most valuable when defenders need a common language across detection engineering, incident response, and security architecture. It makes it easier to explain why multiple controls must overlap, because each stage of an intrusion presents a different chance to deny, delay, detect, or contain the attacker.

It is also useful for reviewing past incidents. Teams can reconstruct where the intrusion was first visible, where it became durable, and which control failure allowed the attacker to progress. That review often surfaces gaps in logging, network visibility, access control, or segmentation that a single alert would not reveal.

In environments where identity misuse is part of the attack path, the model helps tie intrusion phases to credential abuse, session abuse, and privilege escalation. That makes it easier to understand why prevention and detection must extend beyond perimeter controls.

Risk and Threat Considerations

The kill chain itself is not the risk, but the behaviours it describes are. Attackers use early stages such as reconnaissance and delivery to reduce uncertainty, then exploit weak controls to gain execution, persistence, and control over the environment. A defender who only watches for late-stage compromise may lose the chance to interrupt the intrusion before damage is done.

Failure mechanism: Security teams miss one or more stages of the intrusion because telemetry, segmentation, or response coverage is uneven across the path, allowing the attacker to move from initial access to objective completion.

Impact: The result can be broader compromise, quieter persistence, delayed detection, and a longer window for data theft, disruption, or follow-on identity abuse.

Practitioner Guidance

Why practitioners should care: The model is most useful when it is translated into control coverage, not treated as a theory diagram. Map each phase to a concrete detection or prevention capability so gaps become visible before an incident does.

What to watch for: Repeated reconnaissance, delivery attempts, unusual execution paths, and unexpected outbound command channels often indicate that an intrusion is moving through the chain. These signals matter most when they appear together rather than in isolation.

Practitioner takeaway: Use the kill chain as a planning and review tool, then validate that every stage has at least one meaningful control, detection, or response path attached.

Related resources from NHI Mgmt Group

• How should security teams map cloud attacks to the cyber kill chain?
• Why do stolen credentials weaken the cyber kill chain model?
• Why does identity security matter in disrupting the cyber kill chain?
• What is the difference between the Cyber Kill Chain and MITRE ATT&CK for defending against advanced threats?