SESKStuff Everyone Should Know
SESK: Stuff Everyone Should Know · sesk.info/tech-incident-eradication

What does incident eradication remove after containment?

It removes persistence, entry points, and exploited weaknesses.

Start playing free

  1. The incident's foothold ✔
  2. All monitoring tools
  3. Every user account

Why: Containment limits spread, while eradication addresses what keeps the compromise alive. Tasks can include deleting malware, disabling breached accounts, and fixing exploited vulnerabilities.

Huh, didn't know that: Missing one affected host can leave a path for the incident to return.

The dad joke
Eradication changed the locks after containment closed the door.
Like this card?
Play the game

References

Answer: The incident's foothold. Containment limits spread, while eradication addresses what keeps the compromise alive. Tasks can include deleting malware, disabling breached accounts, and fixing exploited vulnerabilities.

  1. NIST SP 800-61 Rev. 3 nvlpubs.nist.gov/nistpubs/specialpublications/nist.sp.800-61r3.pdf
    eradication may be necessary to eliminate persistence mechanisms and entry points
    Checked 2026-10-10.

Think this answer is wrong? Tap "Challenge this answer" on the card in the game and tell us why.

Test yourself in the game

Security & PrivacyWhich activities belong in an incident-handling capability?Security & PrivacyWhat is the immediate goal of incident containment?Security & PrivacyWhich three goals form the CIA triad?

That's stuff everyone should know.