An intrusion started with valid credentials against an internet-facing VPN, with no malware involved until well after initial access. How well does the Cyber Kill Chain describe this, and what would you use instead?

It describes it badly, and this is one of the clearest cases where the model's assumptions show.

Three of the seven phases essentially do not occur. There is no weaponisation, because no payload was paired with an exploit. Delivery is degenerate — the credential was simply used. Exploitation did not happen in the sense the model means, because nothing was exploited; a legitimate authentication succeeded. So the model's early phases, which is where it does most of its work, have nothing to describe.

That reflects two assumptions baked into a 2011 model. It is malware-centric, and it is perimeter-shaped — it assumes an outside-in intrusion with a payload crossing a boundary. Identity-based intrusions break both, and they are now a large share of real activity. It is also linear, whereas this kind of intrusion loops: the actor lands, discovers, moves laterally, and effectively starts a fresh chain internally. And everything interesting here — discovery, lateral movement, collection, exfiltration — collapses into the single Actions on Objectives phase.

ATT&CK fits much better. Initial access is T1078 Valid Accounts, and the post-compromise tactics give proper granularity for discovery, lateral movement, credential access and the rest, so I can describe what actually happened rather than forcing it into phases that do not apply. If I wanted a phase model I would reach for the Unified Kill Chain, which extends the post-compromise portion, or just build a timeline, which is often the honest answer.

I would still keep the kill chain for one purpose: talking to leadership about where controls sit. "We have good coverage at delivery and command and control and almost none at initial access via identity" is a sentence a non-specialist can act on. The practical consequence of this intrusion is exactly that — the detection investment belongs in identity and authentication anomaly work, not in payload inspection at the perimeter.