Prioritise containment actions that stop progression, such as blocking lateral movement paths, constraining downloads, and tightening access on the affected host or identity. The aim is to interrupt the chain before the attacker completes privilege escalation or reaches high-value systems.
Why This Matters for Security Teams
Once an attack sequence is underway, the priority changes from perimeter prevention to interruption of adversary progress. That shift matters because attackers often chain techniques quickly, moving from initial access to credential theft, lateral movement, and privilege escalation before defenders finish triage. A useful lens is the MITRE ATT&CK Enterprise Matrix, which helps teams map observed activity to likely next steps instead of treating each alert as isolated noise.
Security teams often get this wrong by focusing too long on root-cause analysis before they have contained the active pathway. In an active incident, the most valuable question is not only “what happened” but “what can the attacker still do right now.” That means constraining accounts, hosts, tokens, and network paths that enable the next move. It also means preserving enough evidence for investigation while acting fast enough to prevent further compromise.
In practice, many security teams encounter the true scope of an intrusion only after lateral movement or data access has already occurred, rather than through intentional early containment.
How It Works in Practice
Containment works best when it is specific to the attack path that is in motion. If the adversary is using a compromised user or service account, disable or sharply restrict that identity, revoke active sessions, and review privileged group memberships. If the activity is host-based, isolate the endpoint, block suspicious processes, and limit outbound communication that could support command-and-control or payload retrieval. If the sequence involves cloud or SaaS access, review token validity, API keys, and conditional access policy enforcement.
Operationally, teams should treat the incident as a chain of observable techniques and break the chain at the easiest safe point. That often includes:
- Blocking known malicious IPs, domains, or beacons where confidence is high.
- Suspending risky authentication paths, especially from anomalous geographies or devices.
- Disabling scheduled tasks, remote administration, or scripting channels used for persistence.
- Freezing changes on affected systems so evidence is preserved for forensics.
- Coordinating with identity, endpoint, network, and cloud owners so controls do not conflict.
For incident handlers, this is not a purely technical exercise. Good containment depends on an accurate picture of attacker intent, which is why current guidance encourages technique-based analysis and timely intelligence consumption through sources such as CISA cyber threat advisories. When AI-assisted operations are suspected, teams should also consider whether prompt injection, tool abuse, or model-directed tasking is part of the active sequence and compare indicators against MITRE ATLAS adversarial AI threat matrix. These controls tend to break down when identity, endpoint, and cloud telemetry are siloed because responders cannot confidently see which action is actually enabling the next stage.
Common Variations and Edge Cases
Tighter containment often increases business disruption and investigative overhead, requiring organisations to balance attack interruption against service availability. That tradeoff is especially sharp when the affected asset is production-critical, shared by multiple teams, or supports automated workflows.
There is no universal standard for every incident pattern. In some environments, isolating a host is safer than disabling a user because the account may control legitimate business processes. In others, cutting off the account first is the better option because the attacker is moving through cloud services faster than endpoint teams can respond. Best practice is evolving for agentic AI scenarios as well: if an autonomous workflow has execution authority, the containment plan may need to revoke tool access, not just network access. That intersection between AI control and identity governance is becoming more important as enterprises adopt agentic systems that can act through delegated permissions.
Teams should also remember that containment is not the same as eradication. After the immediate path is blocked, defenders still need to validate whether persistence, stolen secrets, or hidden secondary access remain. Guidance from NIST SP 800-53 Rev 5 Security and Privacy Controls is useful here because it reinforces access control, incident response, and monitoring as linked operational disciplines rather than separate workstreams. Anthropic—first AI-orchestrated cyber espionage campaign report is a timely reminder that automation can compress attacker timelines, making delayed response more costly than imperfect but fast containment.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK, OWASP Agentic AI Top 10 and MITRE ATLAS address the attack and risk surface, while NIST CSF 2.0 and NIST AI RMF set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | RS.MA | Active attacks require monitored response actions that stop further progression. |
| MITRE ATT&CK | T1021 | Remote services are a common lateral movement path to interrupt mid-attack. |
| OWASP Agentic AI Top 10 | Agentic systems can be abused mid-sequence through tool use or delegated action. | |
| NIST AI RMF | AI-driven attacks need governance over risk decisions and response actions. | |
| MITRE ATLAS | AML.T0054 | Adversarial AI operations may include prompt injection or model misuse during attack chains. |
Use response communications and active monitoring to contain the incident and coordinate next actions.
Related resources from NHI Mgmt Group
- How should security teams detect token theft if MFA was already completed?
- How should security teams handle stolen OAuth tokens when MFA is already in place?
- How should security teams reduce the attack surface of identity systems?
- How can security teams reduce attack surface without slowing operations?
