What is the Cyber Kill Chain?
The Cyber Kill Chain is a Lockheed Martin model that divides a targeted cyber attack into seven consecutive phases, from reconnaissance to achieving the objective, so that defenders can decide for each phase how to detect and disrupt the attack. The model was described in 2011 by Eric Hutchins, Michael Cloppert and Rohan Amin and is derived from the military concept of a kill chain. The core idea is simple: an attacker has to complete every phase, so one effective control in a single phase is enough to break the chain.
In OT environments, the Kill Chain helps you analyse attacks by groups such as APT actors in a structured way, and above all stop them before they reach the physical process.
🧠 What are the seven phases of the Cyber Kill Chain?
The original paper defines the phases for intrusion and espionage in IT networks. The last column translates them to an industrial environment.
| # | Phase | Definition according to Lockheed Martin | Example in OT |
|---|---|---|---|
| 1 | Reconnaissance | Research, identification and selection of targets | Harvesting job ads, LinkedIn profiles and vendor references; finding open TCP/102 (S7comm) to a PLC |
| 2 | Weaponization | Coupling a backdoor with an exploit into a deliverable payload | An Office document with a macro, or custom Ladder Logic for sabotage |
| 3 | Delivery | Transmitting the weapon to the target environment | Phishing, a USB stick, a vulnerable Remote Access connection or an infected update package (Supply Chain Risk) |
| 4 | Exploitation | Triggering the attacker’s code through a vulnerability or the user | Abuse of engineering software; a PLC that accepts code without Code Signing |
| 5 | Installation | Installing a backdoor or remote access trojan for persistence | Backdoor on an Engineering Station or SCADA web server |
| 6 | Command and Control (C2) | Outbound channel to the attacker, “hands on the keyboard” | Outbound connection via the Historian or a hijacked VPN |
| 7 | Actions on Objectives | The actual goal: stealing data, harming integrity or availability | Manipulating sensor values, disabling a safety function, changing PLC logic |
Between 2004 and 2010, Lockheed Martin saw three dominant delivery routes in APT attacks: email attachments, websites and USB media. In OT, vendor remote access and the supply chain have since joined that list.
🔐 How do you break the Kill Chain in each phase?
The original paper maps each phase to six types of defensive action taken from military doctrine: detect, deny, disrupt, degrade, deceive and destroy. This is known as the courses of action matrix. A host IDS can detect an exploit, patching denies it, and Data Execution Prevention disrupts its execution. A honeypot deceives an attacker who is already inside. For OT, a simplified matrix looks like this:
| Phase | Detect | Prevent or disrupt |
|---|---|---|
| Reconnaissance | SIEM logging, network monitoring for scans | Network segmentation, Firewall, few public technical details |
| Weaponization | Threat Intelligence on tooling and IOCs | Not directly visible; insight via indicators from earlier attacks |
| Delivery | Email Filtering, IDS at the IT/OT boundary | USB Control, Software Whitelisting, a jump server for vendors |
| Exploitation | Vulnerability Scanning, anomaly detection | Patch management, Access Control, Code Signing |
| Installation | EDR on Windows systems in OT | Application Control, Least Privilege |
| Command and Control | DNS Monitoring, traffic to unknown destinations | Proxy, data diode, no direct internet routes |
| Actions on Objectives | Process deviations, honeypots | Zero Trust Architecture, an SIS independent of the control system, Incident Response Plan |
The earlier you intervene in the chain, the greater the chance of stopping the attack without damage.
The model also distinguishes three types of indicator: atomic (an IP address or domain name), computed (hash values) and behavioural (a combination that describes how the attacker operates). Behavioural indicators and TTPs stay useful the longest, because an attacker replaces infrastructure far more easily than working methods.
🏭 What is the ICS Cyber Kill Chain?
In October 2015, Michael Assante and Robert M. Lee published the ICS Cyber Kill Chain through SANS. They argued that an attack with physical impact on an industrial control system requires two stages:
| Stage | Phases | What the attacker does |
|---|---|---|
| Stage 1: intrusion | Planning, Preparation, Cyber Intrusion, Management and Enablement, Sustainment/Entrenchment/Development/Execution | Breaking into the corporate network (or a supplier’s), setting up C2, moving laterally and gathering knowledge about the process |
| Stage 2: ICS attack | Attack Development and Tuning, Validation, ICS Attack | Building a tailored attack, testing it on similar equipment and finally executing it |
Stage 2 is hard to detect because the attacker usually develops the attack outside the target network, based on stolen documentation. Months can pass between the two stages. A deliberate attack on the process requires far more knowledge than an ordinary IT intrusion, although a stage 1 intrusion can also cause an outage by accident.
Two real-world examples:
- Stuxnet - discovered in 2010, but according to later analyses an earlier version was already in development and in circulation from 2005–2007. Delivery most likely went through an infected engineering laptop or USB media, because Natanz had no direct network connection to the outside world.
- Ukraine, 23 December 2015 - the Sandworm group gained access through spearphishing with BlackEnergy 3 (stage 1), stole VPN credentials and then remotely operated the HMIs of three distribution companies. Around 225,000 customers lost power for several hours. To slow down recovery, the attackers also wiped systems with KillDisk and overwrote the firmware of serial-to-Ethernet converters.
🔄 How does the Kill Chain compare with other models?
| Model | Origin | Strong at | Limitation |
|---|---|---|---|
| Cyber Kill Chain | Lockheed Martin, 2011 | Overview, explaining to management, controls per phase | Linear and focused on malware and the perimeter |
| ICS Cyber Kill Chain | SANS, 2015 | Two stages, OT-specific attack development | Less known outside the OT community |
| MITRE ATT&CK / MITRE ATT&CK for ICS | MITRE | Concrete techniques with examples and mitigations | No fixed order; a lot of detail |
| Unified Kill Chain | Paul Pols, 2017 | 18 phases in three blocks (in, through, out), combining Kill Chain and ATT&CK | Harder to explain |
Many organisations use the Kill Chain to tell the story and ATT&CK for detection rules and testing. MITRE D3FEND adds the matching defensive techniques.
🔧 How do you apply the Kill Chain in your OT environment?
A practical approach in six steps:
- Choose scenarios - for example ransomware via phishing, abuse of vendor access and a targeted attack on the SIS. Use Threat Intelligence from your own sector.
- Map visibility per phase - which log sources do you have at the IT/OT boundary, in the DMZ, on the engineering station and inside the OT network itself?
- Fill in the matrix - record per phase and per scenario which control detects, prevents or slows the attack. Empty cells are your blind spots.
- Prioritise early intervention - controls in phases 1–3 (segmentation, managed remote access, a USB policy) are often cheaper in OT than recovery after phase 7.
- Test - play out scenarios in a tabletop exercise or let a Red Team and Blue Team work together as a Purple Team. Threat Hunting looks for traces of attackers who are already in phase 5 or 6.
- Learn from incidents - after every incident, record the phase in which you spotted it. Lockheed Martin also advises reconstructing the earlier phases, so that you stop the next attack earlier in the chain.
In the Netherlands, this ties in with the Cybersecurity Act (Cyberbeveiligingswet), in force since 15 August 2026, which requires risk management and incident reporting (see Cybersecurity Act Incident Reporting). The zones and conduits of IEC 62443 and the Purdue Model determine where your detection and blocking points logically sit, in line with Defense in Depth.
❓ Frequently asked questions
Who created the Cyber Kill Chain?
The Cyber Kill Chain was developed by Lockheed Martin and published in 2011 by Eric Hutchins, Michael Cloppert and Rohan Amin. They based the model on the military kill chain concept and on their own incident response team’s experience with APT attacks.
Is the Cyber Kill Chain suitable for OT?
The Cyber Kill Chain is usable in OT, but it was originally designed for intrusions into IT networks. For industrial environments, the 2015 SANS ICS Cyber Kill Chain extends the model with a second stage in which the attacker develops, tests and executes an attack on the control system.
Why do the early phases of the Kill Chain matter so much in OT?
In the early phases of the Cyber Kill Chain, the attacker has no influence on the physical process yet. Stopping an attack during reconnaissance, delivery or exploitation prevents the downtime, damage and safety risks that can arise in phase 7.
What is the difference between the Cyber Kill Chain and MITRE ATT&CK?
The Cyber Kill Chain describes seven consecutive phases of an attack at a high level. MITRE ATT&CK describes hundreds of concrete techniques, grouped by tactic and without a fixed order, which makes it better suited to detection rules and testing.
What are the criticisms of the Cyber Kill Chain?
The Cyber Kill Chain is linear and strongly focused on malware and breaching the perimeter. Insider threats, abuse of legitimate access and lateral movement inside the network fit it less well, gaps that the Unified Kill Chain and ATT&CK address in more detail.
Is “Cyber Kill Chain” a registered trademark?
Yes, Cyber Kill Chain is a registered trademark of Lockheed Martin and part of its Intelligence Driven Defense approach. The model itself is publicly documented and is used freely worldwide in training and analysis.
📌 In summary
The Cyber Kill Chain divides a targeted attack into seven phases and links defensive controls to each phase. For OT, the ICS Cyber Kill Chain adds a second stage in which the attacker develops and executes the attack on the process. Together with MITRE ATT&CK for ICS, the model gives Security teams, engineers and management a common language.
The Cyber Kill Chain shows how an attack unfolds and where you can stop it; in OT, early detection in phases 1–3 is essential to avoid physical impact in phase 7.