Lockheed Martin Cyber Kill Chain – Interactive Classroom Demo

Click each stage to explore what it means, what defenders look for, and which controls help break the chain. This is a conceptual, defensive-focused walkthrough (not an attack guide).

Kill chain map

Select a stage. The goal for defenders is to interrupt the chain as early as possible.

Activity: map your defences

Tick the controls you have (or want). The bars show which kill-chain stages you cover.

Coverage by stage

Tip: Ask learners which stage their organisation is strongest at, and which is most likely to fail first.

Select a stage

Use the map on the left to load details.

Attacker intent (high level)

    Defender focus (how to break the chain)

      What you might observe (telemetry)

        Controls that help

          Mini scenario walkthrough

          Pick a common incident type and discuss which kill-chain stages are visible, and what “good” response looks like.
          Optional extension: map each stage to your SOC tools (email security, EDR, SIEM, proxy/DNS logs, IAM, backups, incident response playbooks).