The Cyber Kill Chain
A 2011 model that is still the clearest way to talk about intrusion sequence and defensive coverage — provided you can also say where its linear assumption fails.
Introduced by Hutchins, Cloppert and Amin at Lockheed Martin in 2011, the Cyber Kill Chain describes an intrusion as seven ordered phases. Its enduring contribution is the argument attached to it: the defender only has to break the chain once, so map your controls to phases and find the gap.
The seven phases
- Reconnaissance — target research, from public sources to active scanning.
- Weaponisation — pairing an exploit or lure with a payload. Happens entirely on the adversary's side, so it is almost never directly observable.
- Delivery — getting it to the target: phishing, a compromised site, removable media, an exposed service.
- Exploitation — triggering execution, whether through a vulnerability or a user action.
- Installation — establishing persistence.
- Command and Control — the channel back out.
- Actions on Objectives — what they actually came for: collection, exfiltration, encryption, destruction, or staging for the next target.
The part people forget
The original paper's real deliverable is the courses of action matrix: phases down one axis, and detect, deny, disrupt, degrade, deceive, destroy across the other. Filling that grid for a specific adversary is a genuine analytical product, and mentioning it in an interview signals you have read the paper rather than an infographic of it.
When asked to compare frameworks: the kill chain gives you sequence and defensive coverage, the Diamond Model gives you relationships and pivots, and ATT&CK gives you behavioural vocabulary. They are complementary, not competing — an activity thread is a series of diamonds ordered by kill-chain phase, described in ATT&CK terms.
Where it breaks down
Raising these unprompted is usually worth more than reciting the phases:
- It is malware-centric. An intrusion using stolen credentials against an exposed VPN skips weaponisation, delivery and installation entirely. Identity-based attacks fit the model badly, and they are now a large share of real intrusions.
- It is linear. Real intrusions loop: an adversary lands, discovers, moves laterally, and starts a fresh chain internally. The model has no clean way to express that recursion.
- It is perimeter-shaped. It assumes an outside-in intrusion, which fits neither insider threat nor supply-chain compromise well.
- Late phases are compressed. "Actions on Objectives" covers everything from a single document theft to a full ransomware deployment. The Unified Kill Chain and ATT&CK's post-compromise tactics both exist largely to fix this.
Where it still earns its place
For communicating with non-specialists, and for structuring a coverage argument to leadership, it is hard to beat. "We have good detection at delivery and C2, and almost none at reconnaissance or actions on objectives" is a sentence an executive can act on. That is the job.
Run a mock interview on this material. You get the question, a graded response against a vetted rubric, and the probing follow-up an interviewer would ask next.
Related reading
- MITRE ATT&CK for CTI analysts ATT&CK is a knowledge base of adversary behaviour organised by tactic and technique. Most candidates can recite that. Fewer can map an ambiguous artefact correctly, or explain what a heat map does not tell you.
- The Diamond Model of intrusion analysis The Diamond Model exists to make pivoting explicit. Its four vertices are not a taxonomy to recite — they are the four places you can be standing when you ask "what else touches this?"
- The intelligence cycle and F3EAD Every intelligence failure in a CTI team traces back to the first step. If nobody can state the requirement, everything downstream is expensive noise.
- STIX, TAXII and TLP STIX is the data model, TAXII is the transport, TLP is the handling rule. Mixing these up is a common and very visible interview error.