Kill Chain

From F2T2EA to the Lockheed Martin kill chain

The military kill chain describes an attack as an end-to-end sequence rather than a single event, so defenders can reason about where to break it. The U.S. Air Force F2T2EA model breaks the sequence into Find, Fix, Track, Target, Engage, and Assess, where each step depends on the last and failure of any step invalidates the rest. Defense, by inversion, means denying the opponent any one link.

In 2011 the Lockheed Martin Computer Incident Response Team published "Intelligence-Driven Computer Network Defense Informed by Analysis of Adversary Campaigns and Intrusion Kill Chains", authored by Eric Hutchins, Michael Cloppert, and Rhett Amin. That paper reframed the military kill chain as an intrusion kill chain and proposed a seven-stage model that became the most cited reference in cybersecurity. The contribution was not the metaphor alone but the pairing of each stage with a defensive action: detect, deny, disrupt, degrade, deceive, contain. That turned reconnaissance into a concrete intervention point rather than a vague early warning.

The seven stages and where defenders intervene

The Lockheed Martin chain runs reconnaissance, weaponization, delivery, exploitation, installation, command and control, and actions on objective. Reconnaissance happens outside the defended network, which is also the model's biggest detection gap: much of what an attacker does to choose a target leaves little trace inside the perimeter. Weaponization is similarly invisible. Visibility improves from delivery onward, where mail gateways, endpoint telemetry, and network logs start to record evidence.

Each stage pairs with a defensive course of action. Detect means establishing that an intrusion is underway. Deny means blocking information disclosure or access. Disrupt and degrade intervene against command and control channels, while deceive feeds false information back through them. Contain uses network segmentation to limit blast radius. The operational value is that a defender can map existing controls to stages and measure coverage as a fraction of the chain denied.

How CI teams borrow the kill chain

The CI variant is a metaphorical borrowing, not a formal model. Practitioners describe the chain a competitor walks from an internal decision to observable market impact: a strategic decision to enter a segment, an executive hire to lead it, engineering hires and patent or beta activity that reveal investment, a pricing or product page reset, a launch keynote, analyst and PR pushes, and finally sustained campaign air cover. Each stage emits public signals an analyst can capture: job postings, trademark and patent filings, page diffs, keynote registrations, press releases.

The analytical payoff is lead time, not the topology. Stages earlier in the chain suggest the eventual move without confirming it; later stages confirm it with little time to respond. A CI team that monitors competitor websites, pricing pages, job postings, and news in a continuous pipeline can stage detections along the chain rather than discovering the move at the launch keynote, when the response window has collapsed.

Kill chain versus threat-actor profiling and adjacent siblings

The kill chain answers the how: the sequence of stages an attacker or competitor traverses to produce an outcome. Threat-actor profiling answers the who: the identity, motives, playbook, and signatures of the actor moving down the chain. A kill chain without profiling tells you what to watch for but not which competitor is most likely to run it; profiling without a chain tells you who is dangerous but not which signal to monitor.

Adjacent CI concepts specialize parts of the chain. An indicator of change is the per-stage detection unit: the atomic signal that something in the chain has advanced. An attack surface describes the set of observable surfaces a defender can monitor across the chain. Four-corners analysis reads a competitor's intent and capability along adversary axes, complementary to a stage timeline. The threat landscape is the wider environment that decides which chains are likely at any moment.

Limitations of the metaphor

The cyber kill chain has known critiques that transfer in altered form. Early stages happen outside the defender's view, so most detection occurs late. The linear model fits outer-perimeter intrusions poorly against insider threats and modern elastic infrastructure. The Unified Kill Chain, proposed by Paul Pols in 2017, expanded Lockheed Martin's seven stages to eighteen to cover both external and internal phases.

The CI borrowing inherits additional limits. Competitors do not walk a canonical chain: some skip the executive hire, some never reset pricing, some launch quietly. Treating the chain as doctrine over-frames noisy events as inevitable progress toward a move. The honest use is as a checklist of stages to instrument, not a forecast of what comes next.

Frequently Asked Questions

Related terms