A multi-step operation is a cyber campaign built from connected stages, such as probing a target, executing an action, checking the result, and adjusting the next move. Each step may be small on its own, but together they form a coordinated attack path or defensive workflow.
This matters because many intrusions do not succeed in a single attempt. Attackers may retry with different tools, change tactics after a block, or rebuild missing pieces of the operation. Defenders see this as a campaign problem, not just an alert problem. In practice, security teams look for repeated reconnaissance, unusual tool switching, and sustained attempts across time. The same idea also appears in defensive testing: scenario-based exercises and frameworks like MITRE ATT&CK help analysts model how an operation unfolds across multiple stages instead of treating each event as isolated.