You break the cyber attack lifecycle by putting at least one control at each stage an attacker must pass, from reconnaissance to impact, so that a miss early is caught later. You need to stop the attacker only once, but you cannot know where, so you cover several points.
What is the attack lifecycle?
Several models describe it. Lockheed Martin's Cyber Kill Chain, an early and widely cited one, breaks an intrusion into seven steps that an adversary must complete to reach an objective. The idea is that understanding the steps lets defenders disrupt the sequence.
MITRE ATT&CK is a richer, community maintained catalog. Its Enterprise matrix currently lists fifteen tactics: Reconnaissance, Resource Development, Initial Access, Execution, Persistence, Privilege Escalation, Stealth, Defense Impairment, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration and Impact. Each tactic holds many techniques that describe how the goal is achieved.
Tactics are not a strict order. Attackers loop back, skip steps and repeat. Treat the list as a map of what must happen, not a timetable.
Where can you break it?
Think in four zones.
Before the attacker arrives: reduce what they can learn and reach. Limit exposed services, remove stale DNS records and shorten the list of public staff details where practical.
At entry: stop phishing, stolen password use and exploitation of exposed systems. Multi-factor authentication, patching of internet-facing systems and email authentication all work here.
After entry: limit what a foothold can do. Least privilege, application controls, segmentation and credential protection block execution, privilege escalation and lateral movement.
At the objective: catch data theft and damage. Egress monitoring, backup isolation and restore testing reduce the payoff and the impact.
What does a layered break look like?
A constructed example. A phishing email delivers a script that runs on a laptop and then tries to steal browser tokens, reach a file server and upload data.
- Email authentication and filtering may stop the message. If not:
- Application controls may block the script from running. If not:
- Token binding and short session lifetimes limit stolen sessions. If not:
- Segmentation stops the laptop from reaching the file server. If not:
- Egress monitoring flags a large upload to an unfamiliar destination.
Each layer was imperfect. Together they gave five chances to stop one attack.
Which stage deserves the most attention?
The usual answer is the middle. Many organizations invest heavily in perimeter and in backups, and little in lateral movement and detection. Look at your last incident or exercise and ask at which stage you first noticed. The gap between the real start and the first notice is your detection window, and shortening it improves every later outcome.
NIST SP 800-61 Rev. 3, which ties incident response to the Cybersecurity Framework 2.0, helps organizations prepare for incident responses, reduce the number and impact of incidents, and improve detection, response and recovery activities.
How to check or apply this
- Download the ATT&CK Enterprise matrix and make a copy for your environment.
- For each tactic, write the controls you have and the data you collect. Leave blanks where you have nothing.
- Choose three techniques that attackers commonly use against organizations like yours and trace them end to end.
- For each, mark where you would prevent it, where you would detect it and where you would only recover.
- Close the biggest blank first, usually detection after entry.
- Test by simulating one technique safely and measure time to detection.
- Repeat after each incident, and after each major system change.
- Keep records: dated maps and exercise results are useful evidence for auditors and insurers.
Where does Safeguard fit?
For the software supply chain slice of the lifecycle, Safeguard's dependency scanning, policies and gates, and reachability analysis help block known flawed components at build time, and its zero-day discovery aims to surface new weaknesses early. They address entry through software, not the whole lifecycle.
Quick check
Is the cyber kill chain the same as MITRE ATT&CK?
No. The kill chain is a seven step model of an intrusion. ATT&CK is a larger knowledge base of tactics and techniques seen in real attacks, and is not a strict sequence.
Do we need controls at every stage?
Some at each stage, weighted by your risk. The goal is that no single failure lets an attacker reach the end unseen.
Sources
- MITRE ATT&CK Enterprise Matrix
- Lockheed Martin: Cyber Kill Chain
- NIST SP 800-61 Rev. 3: Incident Response Recommendations and Considerations
Last reviewed: 18 October 2026.
