Containment

Containment stops the harm continuing. Eradication removes whatever caused it. They are different jobs and doing the first is not doing the second.

The dangerous moment is the gap between them, because containment feels like success. Systems come back, the alerts stop, everybody is relieved. If the way in is still open, or the attacker still holds a valid account, the quiet is temporary and the next event is the same one continuing. Declaring victory at containment is one of the most common ways incidents get reopened a fortnight later.