Containment

Containment is a critical phase of incident response and may involve isolating an infected endpoint from the network, suspending a compromised user account, blocking a malicious IP address, or quarantining a suspicious email. The goal is to stop the attack from progressing further while the full investigation and remediation process is carried out. Speed of containment directly impacts the total damage caused by an incident.