thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
855-868-4467 Enroll
Enroll HereSign In
thinQpremium
Enroll
Home
thinQbeyond™
Courses
Financing
Theater
Library
Class Rooms
Campus Wire
Campus Tour
Student Rec Center
Student Forum
Browse the catalog Get thinQpremium — All-Access Enroll HereSign In 855-868-4467

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Commonly confused · Security Operations

Cyber Kill Chain vs MITRE ATT&CK: What's the Difference?

The Cyber Kill Chain is a seven-stage linear model describing an intrusion from reconnaissance to actions on objectives. MITRE ATT&CK is a detailed, non-linear knowledge base of real-world adversary tactics, techniques, and procedures used to build detections and assess coverage.

Lockheed Martin Cyber Kill Chain

vs

MITRE ATT&CK

Full definition
Lockheed Martin Cyber Kill ChainMITRE ATT&CK
Structure7 sequential phasesMatrix of tactics (columns) and hundreds of techniques
GranularityHigh levelDetailed, technique and sub-technique IDs
FocusBreaking the chain early, especially perimeter stagesFull lifecycle including post-compromise behavior
Phases/tactics examplesReconnaissance, Weaponization, Delivery, Exploitation, Installation, C2, Actions on ObjectivesInitial Access, Execution, Persistence, Privilege Escalation, Lateral Movement, Exfiltration
Typical useStrategic communication, defense planningDetection engineering, threat intel mapping, purple teaming
OriginLockheed Martin, 2011MITRE, publicly released 2015
Remember it

Kill Chain is the storyline; ATT&CK is the encyclopedia.

Exam tip

Know the seven Kill Chain stages in order. Questions about mapping detections to specific technique IDs (like T1059) point to ATT&CK. The Diamond Model is a third framework focused on adversary, capability, infrastructure, and victim.

Tested on

CompTIA CySA+CompTIA Security+Cisco CCNA Cybersecurity (formerly CyberOps Associate)EC-Council Certified Threat Intelligence Analyst (CTIA)CompTIA SecurityX (formerly CASP+)Microsoft Security Operations Analyst

More Security Operations look-alikes

Intrusion Detection System vs Intrusion Prevention SystemSIEM vs SOAREDR vs XDR vs MDRVulnerability Scan vs Penetration TestBlack-Box Testing vs White-Box Testing vs Gray-Box TestingRed Team vs Blue Team vs Purple TeamSecurity Event vs Security Incident vs Data BreachIndicator of Compromise vs Indicator of AttackCVE vs CVSS vs CWEAll comparisons →
1. Map it thinQguide™ · 409 cert guides2. Learn it thinQterms™ · 7,491 terms3. Untangle it 180 look-alike comparisons4. Prove it thinQready™ · free readiness check