Explain why containment and eradication are separate stages, and describe one risk of skipping either stage.

### The concept Containment is a temporary control on the incident's reach. Teams may isolate a compromised endpoint, restrict an account, or segment a network so an attacker cannot keep moving. Eradication follows by removing malware, persistence mechanisms, and relevant weaknesses. A containment action does not prove the cause has been removed. Similarly, deleting a malicious file without limiting attacker access may leave the organization exposed while investigation continues. ### What a good answer covers - Containment limits spread and immediate impact. - Eradication removes the threat and its enabling cause. - Skipping containment can permit additional compromise or disruption. - Skipping eradication can allow persistence or reinfection after recovery. ### Terms - **Lateral movement**: An attacker's movement from one compromised system or account to others. - **Persistence**: Methods that let an attacker retain access over time. ### Remember Containment controls where the incident can go; eradication removes what is causing it.