Which Cyber Kill Chain links does a buyer of working VPN credentials never traverse?

## The scenario An access broker sells a position: a working remote-access credential into a managed-service provider's shared tenancy, together with a delegated administration path that reaches the provider's customers. An affiliate buys it. Their first action inside the estate is to go after what they came for. Narrate that with the seven-stage chain and something strange happens: most of the diagram is empty. ## Link by link, for the buyer **Reconnaissance — not traversed.** The buyer did not research this estate. They read a listing. Someone did reconnaissance, but it was the broker, at a different time, and quite possibly as an untargeted sweep that happened to include this estate. **Weaponization — not traversed.** Nothing was paired with a carrier. There is no document, no installer, no crafted object at all. There is a username, a secret and a service that accepts them. **Delivery — not traversed.** Nothing was sent to anybody. No message arrived, nothing was downloaded, no media was plugged in. The buyer connected to a service that exists for people to connect to. **Exploitation — not traversed, and this is the one people get wrong.** Presenting a valid credential to a service that then accepts it is not exploitation. No memory is corrupted, no logic is subverted, no unpatched component is reached. The authentication decision was made correctly on the inputs it was given; the inputs were simply someone else's. A path with no exploit on it cannot be interdicted by removing exploitable code. **Installation — optional.** Installation exists so that access does not depend on repeating Delivery and Exploitation. When the thing you bought is standing remote access plus a delegated administration path, that requirement is already satisfied at purchase. The buyer may still add something of their own, and if they do, this link genuinely returns to the narrative — but it was not required to get started. **Command and Control — satisfied by design.** The remote-access service is the channel. It is meant to carry an operator's instructions to the estate; it does not care which operator. **Actions on Objectives — the first act.** In a clean bought-access intrusion this is where the buyer's story begins, which is a genuinely disorienting thing to write on a stage diagram. ## What this does, and does not, prove It is tempting to conclude that the kill chain is broken as a model. That is the overreach. What the example falsifies is the **universality of the interdiction claim**, not the model's usefulness on the paths it was built for. The claim "break one link and the intrusion fails" is sound whenever the intrusion needs the link. Here, four of the seven links are not needed by this party, so interdicting them removes nothing from this path — there is nothing there to remove. Note carefully what the early stages' absence does *not* mean. It does not mean nobody performed them. Reconnaissance and, very often, an exploited internet-facing service or a stuffed credential is exactly how the broker produced the listing. The stages happened; they happened **for a different party, at a different time, and amortised across an inventory of victims**. The buyer inherited the *result* without traversing the *path*. If you narrate the whole affair as one intrusion by one actor, the chain looks complete and you will draw the wrong conclusion; if you narrate the buyer's intrusion, four links are blank. ## The same shape, other origins Bought access is the cleanest example but not the only one. Any position that already exists enters mid-sequence: a person who holds legitimate access and turns it to their own ends traverses none of the first four links either, because their access was granted, not obtained. The shared feature is the one that matters for the model — **entry with no exploit and no delivery anywhere on the path**. ## How to answer this in a loop Name the four links, say why each is empty, and then say the sentence the interviewer is waiting for: the earliest link this party touches is Installation, and where the purchased access is itself persistent, even that is skipped. Finish with the consequence rather than a verdict on the model — a control class attached to Delivery or Exploitation is not a claim about a path that traverses neither.