Most attacks are not a single magic moment. They unfold in stages. Seeing the stages helps defenders catch an attack before it finishes.
What is it?
An attack lifecycle is the series of steps an attacker takes from first look to final goal. Security teams map their defences against these stages — the earlier they catch an attacker, the less damage is done.
Select any component in the diagram to read what it does.
Text description of this diagram
Most attacks follow the same broad stages, from research to reaching the attacker's goal.
The stages
- Reconnaissance — the attacker researches the target (staff names, emails, software in use).
- Initial access — they get in, often via phishing or a software weakness.
- Establish foothold — they install tools so they can return.
- Escalate & move — they gain more powerful access and spread to other systems.
- Achieve the goal — steal data, deploy ransomware, or cause disruption.
Why is it important?
Defence is not one wall at the entrance; it is checkpoints at every stage. Even if an attacker gets past step one, they can still be detected and stopped at steps two, three, or four. This is the idea behind “defence in depth”, which you will meet in Module 3.
How does it work?
At each stage, defenders have a chance to detect or block the attacker. For example: spam filters fight reconnaissance and initial access; antivirus fights foothold; network monitoring spots unusual movement; and backups limit the damage of the final goal.
A real-world example
In a typical ransomware case, attackers spend weeks quietly inside a network — researching, spreading, and disabling backups — before they trigger the ransomware on day one that victims notice. Organisations that monitored for the quiet earlier stages caught and evicted the attackers before the damage was done.
Check what you learned
Why is it useful to know an attack happens in stages?
Because defenders get multiple chances to detect and stop the attacker — not just at the entrance.
What usually comes first: stealing data or reconnaissance?
Reconnaissance — attackers research the target before they try to get in or reach their goal.
Key takeaways
- Attacks unfold in stages, from reconnaissance to the final goal.
- Defenders can detect and stop an attacker at any stage.
- Catching an attack early greatly reduces the damage.