Glossary

Breach containment

Breach containment is the work of stopping an attacker's access to systems and data as soon as an incident is discovered. It cuts credentials, isolates affected systems and removes the footholds left behind, and it comes before any restore of data.

Why is the attacker often still inside after discovery?

Discovery is not the end of an intrusion. The alert that revealed it often came from the attacker's noisiest action, while quieter access had been established earlier. Declaring the incident over once the first compromised machine is cleaned leaves the attacker with the rest, and the cleanup tends to be followed by a second round of activity.

The three actions of containment

  1. Revoke credentials. Reset or disable the accounts, tokens and keys the attacker used, including service accounts and API keys, and end active sessions.
  2. Isolate systems. Disconnect affected hosts and network segments so the attacker cannot move or reach data, while keeping them powered where forensic evidence is needed.
  3. Remove persistence. Delete what was left to get back in: backdoors, scheduled tasks, new accounts, altered startup entries and added remote access tools.

Evidence is preserved throughout, because the same logs and disk images later show what was taken and how, which matters for data exfiltration assessment and for regulators.

Scoping to the credential, not the host

The common mistake is scoping containment by the first machine found. A stolen login reaches everything its owner could reach, which can be many systems across the domain, the cloud account and the backup environment. Containment is therefore scoped by what the stolen credentials could touch. A domain administrator login reaches far more than the laptop where it was captured, and the same logic applies to insider accounts. Deciding in advance who can approve shutting a system down avoids losing hours to an approval chain during the incident. Logging every credential reset and isolation action as it happens also gives the recovery team a record of what was changed and when.

Why contain before restoring?

Restoring first puts clean data into an environment that is still compromised. The attacker, still holding access, can encrypt it again or delete the restored systems, and the organization pays for recovery twice. Containment comes first, then recovery from a copy the attacker could not have touched, such as an immutable backup, then verification that the environment is clean. The sequence is also the reason backup repositories are part of the containment scope. Credentials that can reach the backups can reach the recovery, as covered under ransomware recovery.

Frequently asked questions

How long does containment take?

From hours to days, depending on how many systems and accounts are involved and how well the environment is mapped. Rushed containment that misses footholds extends the incident.

Is containment the same as eradication?

They are adjacent steps. Containment stops spread and access. Eradication removes the root cause and malicious artifacts completely, and the two often overlap in practice.

Does containment need to be taken offline?

Often partially. Isolating segments limits damage, but a full shutdown is a business decision weighed against evidence needs and service impact.