Seven Steps to Breach: Understanding the Anatomy of a Modern Cyberattack

When news broke that a major US healthcare network had exposed the records of millions of patients, or that a retail chain's point-of-sale systems had been silently harvesting card data for months, the public narrative almost always focused on the outcome: the stolen records, the financial losses, the regulatory fines. Rarely examined was the journey — the sequence of deliberate, patient steps that carried attackers from initial curiosity to full operational control of a target's environment.

That sequence has a name in the cybersecurity profession: the cyber kill chain. Originally articulated by Lockheed Martin's security researchers in 2011 and subsequently refined by practitioners across the industry, the kill chain framework maps the lifecycle of an intrusion from first contact to final objective. It is not a theoretical construct. It is a forensic reality, reconstructed from incident-response investigations conducted after hundreds of real-world breaches. Understanding it changes the way you think about where security actually matters.

Phase One: Reconnaissance

Attackers do not begin by attacking. They begin by watching.

Reconnaissance — the intelligence-gathering phase — may consume more time than all subsequent phases combined. In passive reconnaissance, the attacker collects publicly available information without ever touching the target's systems: LinkedIn profiles that reveal the names, titles, and technology stacks used by IT staff; job postings that inadvertently disclose which security products an organization runs; domain registration records; conference presentations given by engineers that reference internal architecture. None of this triggers an alert. None of it is illegal.

Active reconnaissance is more direct: scanning the target's internet-facing infrastructure for open ports, running version-detection probes against web servers, mapping subdomains. Tools such as Shodan — a search engine that indexes internet-connected devices — allow sophisticated reconnaissance from a distance. The 2020 SolarWinds intrusion, widely attributed to Russian state-sponsored actors, was preceded by months of reconnaissance during which attackers studied the software development and update processes of a trusted vendor before ever deploying malicious code.

What this means for defenders: Information hygiene matters. Limiting what technical details appear in public job postings, configuring servers to suppress version banners, and monitoring for scanning activity against your perimeter all raise the cost of reconnaissance.

Phase Two: Weaponization

With sufficient intelligence gathered, the attacker constructs or acquires the tools for the intrusion. This might mean crafting a phishing email tailored to a specific employee — referencing their job title, their manager's name, a project they recently discussed publicly — and pairing it with a malicious attachment or link. It might mean purchasing access to a previously compromised credential from a dark web marketplace. It might mean acquiring a zero-day exploit targeting software the target is known to run.

Weaponization is largely invisible to defenders, because it happens entirely within the attacker's own environment. This is why the subsequent delivery phase is so critical as a defensive opportunity.

Phase Three: Delivery

The weapon reaches the target. In the majority of documented breaches, delivery occurs through one of three vectors: phishing email, compromised credentials used to authenticate to an exposed service, or exploitation of a vulnerability in an internet-facing application.

The 2021 Colonial Pipeline ransomware attack — which disrupted fuel supplies across the US East Coast — was initiated through a single compromised VPN credential. No sophisticated exploit was required. The credential, likely obtained from a prior breach, was simply used to log in. Delivery, in that case, was indistinguishable from a legitimate authentication event.

What this means for defenders: Multi-factor authentication (MFA) on all remote-access services is the single most effective control at the delivery phase. A stolen credential without a corresponding second factor cannot complete the delivery. CISA data consistently shows that organizations with MFA enforced across remote access experience dramatically lower rates of credential-based intrusion.

Phase Four: Exploitation

Once delivered, the attacker's tool or access must exploit something to gain a foothold. In phishing-based attacks, exploitation occurs when the user executes a malicious attachment or enters credentials into a spoofed login page. In vulnerability-based attacks, exploitation involves triggering a flaw in software to execute arbitrary code.

Notably, exploitation does not always require a technical vulnerability in the traditional sense. Social engineering — manipulating a help desk employee into resetting an account's MFA, for example — constitutes exploitation of a human process rather than a technical one. The 2022 Uber breach involved an attacker who, after obtaining a contractor's credentials, bombarded the contractor with MFA push notifications until the contractor accepted one simply to stop the alerts — a technique known as MFA fatigue.

Phase Five: Installation

Having gained initial access, the attacker installs persistent mechanisms to ensure continued access even if the initial entry point is closed. This might involve deploying a remote access trojan, creating a new administrative account, or modifying scheduled tasks and startup processes. The objective is survivability: the ability to return to the environment even after the original vulnerability is patched or the original credential is reset.

Persistence mechanisms are frequently designed to blend into normal system activity — disguised as legitimate services, named to resemble operating system components, or embedded in locations that automated scans are configured to trust.

Phase Six: Command and Control

The installed implant establishes a communication channel back to the attacker's infrastructure, enabling remote direction of activities within the compromised environment. Modern command-and-control (C2) traffic is often designed to mimic legitimate web traffic, using encrypted HTTPS connections to domains that appear benign, making detection by network monitoring tools substantially more difficult.

This phase can persist for extended periods — months, in sophisticated intrusions — while the attacker conducts internal reconnaissance, escalates privileges, and moves laterally through the network toward high-value targets.

Phase Seven: Actions on Objectives

The final phase is where the attacker executes whatever goal motivated the intrusion: encrypting files for ransom, exfiltrating sensitive data, manipulating financial records, or establishing long-term espionage access. By the time most organizations detect a breach, the attacker is already in this phase — meaning the prior six phases unfolded without triggering a defensive response.

IBM's Cost of a Data Breach Report consistently finds that the average time to identify a breach in the United States exceeds 200 days. That figure represents the cumulative success of the preceding phases in evading detection.

Why the Framework Changes the Defensive Calculus

The kill chain's value is not merely descriptive — it is prescriptive. Because an intrusion must successfully complete each phase to reach its objective, a defense that reliably disrupts any single phase breaks the chain. Organizations with limited security budgets are often more effective when they concentrate controls at the phases where disruption is most achievable: delivery (MFA, email filtering), exploitation (security awareness training, patching discipline), and installation (endpoint detection and response tools).

For individual users, the lesson is similar. Your personal security posture — unique passwords managed through a password manager, MFA on every account that offers it, skepticism toward unsolicited communications — directly addresses the phases through which most attacks against private individuals are conducted.

Every breach begins with a single mistake. Understanding the seven stages that follow that mistake is the most important context any defender — organizational or individual — can possess.