Attack chains

The tidy linear diagrams are communication tools, not descriptions of how intrusions actually go.

Real attacks loop, backtrack, run stages in parallel and skip steps entirely. The model is useful for explaining and for organising detections, and it becomes misleading when people expect to observe the stages in order or assume that catching one means the sequence has stopped.