Containment

Containment is the incident response phase focused on limiting the spread and impact of an active security incident. Actions include isolating compromised systems, revoking credentials, blocking malicious IPs, and disabling compromised accounts.

Short-term containment prioritizes stopping damage quickly; long-term containment involves hardening the environment while systems are rebuilt.