Short-term containment

Isolating a machine buys hours. It does not buy resolution.

Fast containment stops the immediate bleeding and gives you time to understand what happened. Durable containment often means something much larger: rebuilding trust in credentials, rotating keys, and in a serious directory compromise rebuilding the directory itself. Treating the quick action as the end of the incident is how organisations get reinfected a fortnight later.