What Is the Cyber Kill Chain and How Do You Use It to Stop Attacks?

The average data breach in Canada now runs 205 days from first intrusion to full containment, and it costs a record $7.11 million. Attackers do not reach the payoff in one move. They work through a sequence of steps, and every step is a chance for you to stop them. The cyber kill chain maps those steps. Learn the chain and you turn a vague fear of getting hacked into a concrete list of points where your defences break an attack before it reaches your data.

The model comes from Lockheed Martin, which adapted a military targeting concept for network defence in 2011. Its Cyber Kill Chain breaks an intrusion into seven stages. An attacker has to complete each stage in order. Miss one and the attack stalls. Your job as a defender is to detect and disrupt the chain as early as possible, long before the final stage where the damage lands.

The seven stages of the cyber kill chain

Stage one is reconnaissance. The attacker studies your organization, collecting staff names, email formats, exposed services, and leaked credentials. Stage two is weaponization. They build the payload, pairing an exploit with a malicious file or link. Stage three is delivery. They send the weapon through email, a compromised website, or a USB drop. Stage four is exploitation. The code runs and takes advantage of a flaw in software or human behaviour. Stage five is installation. Malware plants itself so the attacker keeps access even after a reboot. Stage six is command and control, often shortened to C2. The malware phones home and waits for orders. Stage seven is actions on objectives. Now the attacker does what they came for, stealing data, encrypting files for ransom, or moving deeper into your network.

Why the order matters for your defence

The strength of the model sits in its sequence. Each stage gives you a different way to intervene. Block a phishing email at delivery and the attacker never reaches exploitation. Flag an odd outbound connection at command and control and you cut off the attack before data leaves. Security teams map their tools and controls to each stage, then look for gaps. A firewall and email filter cover the early stages. Endpoint detection and network monitoring cover the middle. Data loss prevention and segmentation guard the final stage. When you see your defences this way, you stop buying random products and start closing real gaps.

What the Canadian threat picture tells you

Speed is the problem. The Canadian Centre for Cyber Security, in its National Cyber Threat Assessment 2025-2026, names ransomware the top cybercrime threat to Canadian critical infrastructure. Incidents known to the Cyber Centre have grown about 26 percent year over year since 2021. Attackers also move faster once a new flaw appears, launching attacks within days of public disclosure. Global median dwell time, the gap between intrusion and detection, fell from 16 days in 2022 to 10 days in 2023. Shorter dwell time sounds like progress, but it also means defenders have less room to catch an attack in its early stages. The kill chain gives your team a shared map to spot the signs sooner.

The limits of the model

The kill chain fits intrusions driven from outside the network best. It does less well with insider threats, where the attacker already holds access and skips the early stages. It also treats an attack as a straight line, while real campaigns loop and branch. Many teams pair the kill chain with the MITRE ATT&CK framework, which maps the specific techniques attackers use inside each phase. Use the kill chain for the big picture and ATT&CK for the detail. Together they give you both the strategy and the tactics.

Turn the model into a working defence

Start with one real incident or a tabletop scenario. Walk it through all seven stages and ask a plain question at each one: would we see this, and would we stop it? Write down the gaps. Assign each gap an owner and a control. Repeat the exercise every quarter and after every major change to your systems. This habit turns the kill chain from a diagram on a slide into a live defence your team rehearses.

Build the skills behind the chain

A framework only works when your people know how to apply it. Detecting an attack in its early stages calls for analysts who read logs and alerts with a trained eye. The Certified Cybersecurity Analyst program builds the monitoring and triage skills SOC roles depend on. To understand how attackers think across the chain, the Certified Professional Ethical Hacker track teaches the offensive techniques behind each stage, so your defenders know what they face. Reconnaissance and command and control make more sense once your team tracks adversaries directly, which the Certified Threat Intelligence Analyst path covers. When an attack reaches the final stage, the Certified Incident Handling Engineer program gives your responders a structured method to contain and recover. Mile2 trains to real roles, so your staff leave with skills they apply the next day.

Attacks are not single events. They are chains, and a chain breaks at its weakest link, this time for the attacker. Map your defences to the seven stages, find the points where you fall short, and train the people who watch each one. Break the chain early and the breach never reaches your front page or your balance sheet.