Kill Chain Defense Mapper

About this interactive

What you'll learn

• Map a defensive control to the Cyber Kill Chain phase it is meant to break, from reconnaissance through actions on objectives
• Explain why breaking any one link of the chain can stop an attack, and what defenses each phase calls for

Aligned to

Key terms

Cyber Kill Chain

The Cyber Kill Chain is a Lockheed Martin threat model describing the seven stages of a targeted cyberattack — reconnaissance, weaponization, delivery, exploitation, installation, command and control, and actions on objectives — used to structure defensive strategies.

Intrusion Prevention System

IPS

A system that monitors network traffic and actively blocks detected threats in real time.

Host-based Intrusion Prevention System

HIPS

Host-based Intrusion Prevention System monitors endpoint activity and actively blocks malicious behavior such as unauthorized code execution, process injection, and suspicious file modifications.

Egress Filtering

The practice of monitoring and restricting outbound network traffic based on security policies.

Phishing Simulation

A controlled exercise that sends fake phishing emails to employees to test and reinforce their ability to recognize and report phishing attempts.

Dark Web

A part of the internet not indexed by standard search engines, commonly used for anonymous and often illegal activities such as trading stolen credentials, exploits, and malware.

Command and Control

C2

Command and Control refers to the infrastructure and communication channels used by attackers to issue instructions to and receive data from compromised systems, enabling persistent access and coordinated attack operations.

Topics

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.