Is 'reached Kill Chain stage N of seven' a sound way to score every intrusion for leadership?
answer
- the ask is legitimate, the instrument is not
- an ordinal is distance along one road
- what is N when the operator finished at Impact?
- offer quantities defined for every episode
- objective reached, goals observed, elapsed time
basics
~20 sNo, as a universal score. An ordinal assumes every episode traverses the same stages once, in order, so it is undefined for one that repeats a goal and skips several. Offer instead: objective reached or not, which goals were observed, and time to that point.
solid answer
~50 sNot as a universal score, and the honest answer is not a flat refusal. An ordinal only means something for episodes that actually traverse an ordered sequence; a publicity-driven defacement that re-entered Discovery three times, never reached Persistence and finished at Impact has no defensible N — any value either overstates what the operator did or hides that they already got what they came for. But the underlying ask is legitimate: leadership wants episodes to be comparable over time. So supply things that are defined for every episode — whether the operator's objective was reached, the set of goals actually observed, and the time from the first observed action to the objective — and be explicit that unobserved is not the same as absent. Refusing the false ordinal while handing back a comparable summary is the whole of the judgment here.
go deeper
Know that the seven ordered stages and the unordered goal columns are different instruments, and that an episode which repeats a goal and skips most of them has no single stage number.
Be ready to show concretely why the ordinal breaks: pick an episode, try to assign N, and explain why both the high and the low value say something false about the operator.
Show that you can supply a replacement rather than only an objection — quantities defined for every episode, with the observational caveat stated once and not buried.
Own the negotiation. Name the need behind the request, reject the instrument without rejecting the need, defend the replacement against 'I cannot chart a set', and say plainly what the ordered model remains the right tool for.
## The ask is reasonable; the instrument is wrong Someone senior asks for one number per intrusion so the organisation can compare this quarter with last. The number offered is 'stage N of seven'. This is a question about what can honestly be represented, and the failure modes are symmetrical: agreeing produces a number that quietly lies, and refusing outright leaves a real need unmet and gets you routed around next time. ### Why the ordinal breaks An ordinal encodes three assumptions at once: that every episode traverses the same stages, that it traverses them in order, and that it visits each one at most once. Real episodes violate all three. Take the defacement of a public-facing web estate. The operator gets in, looks around three separate times as each new decision arises, changes the front page, and leaves. There is no Persistence, no second host, and nothing that resembles a later stage. What is N? If you score the visible effect high, you imply an operator who progressed deep into an estate, which is false — they never left the first foothold. If you score it low because most stages were untouched, you imply the episode was contained short of its goal, which is also false — the operator finished. The number has no honest value, and both wrong values are actively misleading to the person acting on them. The deeper point is that an ordinal is a *distance travelled* measure, and it only works when there is one road. This tree's whole subject is that intrusions do not travel one road: goals recur, most are never pursued, and the sequence differs by what the operator is paid in. ### What the ask is really for Before you answer, name the need out loud, because it decides what you offer instead. Leadership usually wants one of three things: comparability across episodes, a sense of how bad this one was, or a trend over time. None of those requires an ordinal — they require quantities that are *defined for every episode*, which the stage number is not. ### What to offer instead Three things, all defined regardless of what shape the episode took: 1. **Was the operator's objective reached?** A yes/no, argued explicitly. It is the question leadership is really asking when they ask how far someone got, and it does not care how many stages exist. 2. **Which goals were actually observed**, as a set rather than a position — including the informative absences. 'No Persistence, no Exfiltration' tells a reader more about this crew than any number would. 3. **Time from the first observed action to the objective.** This is a real quantity, comparable across episodes, and it moves for reasons anyone can act on. Add one standing caveat: these describe what was observed. An empty goal is not proof that the goal was never pursued, and any trend built on these numbers inherits that limit. ### Holding the line on comparability Expect the pushback: 'the set is not a number, I cannot chart it.' Two answers. First, the yes/no and the elapsed time are both chartable and both defensible, so the charting need survives. Second, and more importantly, an ordinal that is undefined for a third of your episodes is not comparable either — it merely looks comparable, which is worse, because two episodes landing on the same N can differ entirely in whether the operator got what they came for. Comparability that hides the outcome is not the property anyone actually wanted. ### Where the ordered model still earns its keep Do not leave the impression that the seven-stage model is useless. Ordered stages are a genuinely good instrument for reasoning about a *dependent sequence* — arguing about a chain where each link presupposes the one before. That is what the model was designed to support. What it cannot do is act as a universal ruler applied after the fact to episodes that never traversed a chain. Naming both — this is the right instrument for that argument, and the wrong one for this score — is what separates a principled 'no' from an obstructive one. ### The shape of the answer Agree with the need, reject the instrument, supply a replacement that is defined everywhere, state the observational caveat once, and say what the ordered model *is* good for. Leadership gets something they can use, and nobody downstream inherits a number that asserts an order the episodes did not have.
- If leadership insists on exactly one number, which is least misleading?Whether the operator's objective was reached, as a yes/no per episode, paired with the time from the first observed action to that point. Both are defined for every episode whatever shape it took, both are chartable over a quarter, and neither asserts an order the episode did not have.
- Why is it dangerous when two episodes land on the same stage number?Because equal ordinals imply equal outcomes. An episode where the operator finished what they came to do and one where they were still looking around can produce similar numbers while differing completely in whether anything was achieved — and the number hides exactly the difference that matters.
- What is the ordered seven-stage model genuinely good for, then?Reasoning about a dependent sequence, where each link presupposes the one before it. That is the argument it was built to support. It stops being sound the moment it is used as a universal ruler applied after the fact to episodes that never traversed such a chain.
saying these in an interview costs you the question
- Accepts the ordinal because someone senior asked for it
- Refuses without offering anything comparable
- Assumes a higher stage number always means a worse episode
- Compares two episodes by number without asking what was achieved
- Presents observed goals as a complete account of what happened