The model frames an intrusion as a chain of dependent phases: interrupting any link can, in principle, frustrate the attacker’s objective. It gave defenders a shared structure for mapping detections, mitigations, and intelligence to points in an attack’s lifecycle rather than only to tools or indicators.
Its limits are structural. Real intrusions iterate, skip stages, blend with legitimate activity, and move through cloud, identity, and supply-chain paths the original host- and malware-centric model did not describe. Later work such as the Unified Kill Chain extends the staging, while MITRE ATT&CK catalogs observable behaviors without prescribing a linear order.
Key points
Model structureSeven stages describe progression from initial reconnaissance to actions on objectives; the model emphasizes that earlier interruption is cheaper and safer than late-stage response.
Defensive useMap telemetry, detections, and controls to each stage to find coverage gaps, and use the stages to organize intelligence and post-incident analysis.
AnalysisRecord which stage each piece of evidence represents and where the chain was actually broken — an intrusion discovered at command and control was not stopped at delivery.
Important limitationThe model assumes a sequence real adversaries need not follow. Credential theft, living-off-the-land, insider activity, and cloud control-plane abuse fit the staging poorly, and the model says nothing about attacker intent or skill.