Cyber Kill Chain: Attack Interception Simulator

Attack Traffic

Attempt rate 4 / sec

Defense posture

Overall control strength 100%

Live Readouts

Attempts

Breaches

Breach rate

0.0%

Kill-Chain Stages

How it works

The Lockheed Martin Cyber Kill Chain models an intrusion as seven sequential stages: Reconnaissance, Weaponization, Delivery, Exploitation, Installation, Command & Control, and Actions on Objectives. An attack only succeeds — a "breach" — if it survives every gate.

P(breach) = ∏ᵢ₌₁⁷ (1 − pᵢ)

pᵢ = detection/block probability at stage i
   = base(posture, i) × (strength / 100), capped at 0.95

Each simulated attempt is an independent Bernoulli trial at every gate it reaches. The three defense postures spend the same detection budget differently:

Traditional — nearly all effort at Delivery/Exploitation (the perimeter firewall/AV choke point); Reconnaissance and Command & Control go almost unwatched.
Defense-in-Depth — moderate, roughly even coverage across all seven stages.
Shift-Left — heaviest coverage at Reconnaissance and Weaponization, catching attackers before a payload ever gets delivered.

The strength slider scales every stage's probability together (a stand-in for security budget/maturity), and the live "Breach rate" readout is the running empirical estimate of P(breach) from the particles that have finished the chain — it should converge toward the theoretical product above as more attempts run.

In-flight attempt Blocked at gate Breach (reached end)

⚠ Couldn't load the 3D engineThree.js failed to load from the CDN. Check your connection and reload.