What it means
Cyber Kill Chain analysis organizes adversary activity into stages so defenders can identify opportunities to disrupt an operation before its objective is achieved.
Why it matters
The model supports communication and control planning, but real intrusions are iterative and do not always follow a single linear path.
Practical focus
- Map evidence to stages without forcing a fit
- Identify controls and detections at several stages
- Use the model with behavior-focused frameworks
- Review where prevention failed and detection succeeded
Common mistakes
- Treating the model as a complete adversary taxonomy
- Assuming every intrusion begins at the same stage
- Ignoring repeated or parallel actions
- Focusing only on perimeter prevention
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: