Attack Methodologies
Most attacks, however different they look, move through the same broad stages. Learning this “attack lifecycle” helps you see what an attacker is trying to do next — and where to stop them.
Select any component in the diagram to read what it does.
Text description of this diagram
Most attacks move through the same broad stages. Understanding them shows where defences can break the chain.
Security professionals describe this progression with models such as the Cyber Kill Chain and MITRE ATT&CK. The exact names vary, but the idea is the same: an attack is a sequence, and breaking any single link disrupts the whole thing.
The stages, step by step
- Reconnaissance — the attacker researches the target: people, systems, and exposed services.
- Initial access — they get a foothold, usually through phishing, stolen credentials, or an unpatched flaw.
- Execution — malicious code runs on a machine inside the environment.
- Privilege escalation — they gain higher (often administrator) powers.
- Lateral movement — they spread from the first machine to servers and other systems.
- Exfiltration & impact — they steal data, encrypt files for ransom, or disrupt services.
Defenders add two more stages of their own on top: detection (spotting the activity) and response / containment (stopping it and recovering). The earlier in the chain you detect an attack, the less damage it can do.
See it in action
The interactive simulations animate these exact stages for phishing, ransomware and web-application attacks — and show the defensive control that breaks the chain at each point.