Yes. Credential containment usually comes first because encryption is often the final step in a longer intrusion. If you stop the identity abuse early, you reduce the attacker’s ability to move laterally, maintain access and return with a second attempt. That is a better control point than waiting for the payload.
Why credential containment usually beats waiting for the encryptor
credential containment is the higher-value control point because it targets the intrusion path, not just the final payload. If an attacker still has valid identity material, they can often re-enter through another host, service, or token even after one ransomware attempt is blocked. The practical question is whether you can stop the access path from being reused before the attacker turns it into wider impact.
That is why containment should focus on the credential, session, token, or account the attacker is using, not only on the malware process you can see. Blocking encryption can be useful, but it is usually a later-stage defence. By the time payload execution is visible, the intruder may already have lateral movement, persistence, or staged access for a second run.
Teams often underestimate how much resilience lives in identity controls. Guide to the Secret Sprawl Challenge is a useful reminder that exposed credentials are not a one-off hygiene issue, they are a repeat-access problem that can persist across repos, pipelines, and shared tooling. The same logic applies when the attacker has obtained a token, API key, or service credential that can be reused elsewhere in the environment.
What actually has to be contained first
The first containment move is to identify the access primitive that made the intrusion possible. That may be a user password, session, API key, OAuth token, service account credential, or a cloud access key. If you only isolate the endpoint while leaving the stolen credential active, you have not really closed the path.
Containment should therefore cover revocation, rotation, session invalidation, and any privilege reduction needed to prevent reuse. In environments with shared secrets or long-lived credentials, this becomes even more important because one exposed secret can be enough for repeated access. The right response is usually to cut off the trust relationship before debating whether encryption has already started.
Secrets Management Guide supports that approach by framing rotation, dynamic secrets, and secretless patterns as the practical controls that reduce the window in which stolen credentials remain usable. If the attacker can still authenticate, they still have a path, even if the original host has been cleaned up.
For organisations using application or platform keys, the containment question is often whether the key has been scoped narrowly enough to make rapid revocation safe. API Key Management Guide is relevant here because a leaked key should be treated as a live access artifact, not merely a secret that might have been viewed. The response needs to be driven by exposure potential, not by whether encryption activity has already been observed.
When encryption-blocking still matters, and why it is not enough
Stopping encryption attempts is still important because it limits immediate damage on the affected host or file set. But it is a local control against a downstream effect. If identity abuse is still intact, the attacker may return through a different system, a different token, or a later time window when detection is weaker.
That is why the most effective sequence is usually identity containment first, then host and data protection, then broader hunt and recovery actions. CIS Controls v8 is a good general reference for this layered response because access control, account management, audit logging, and malware defence all contribute to limiting repeat compromise. The balance matters: encryption prevention reduces damage, but credential containment reduces the chance of a second foothold.
When the attacker has already moved laterally, the decision becomes even clearer. Encryption can be the visible symptom of a deeper identity compromise, so the containment priority is to break the attacker’s ability to authenticate, authorize, and return. If the team reverses the order, it may suppress the symptom while leaving the cause untouched.
Risk and Threat Considerations
The main risk is allowing a live credential to outlast the visible attack. That creates repeated intrusion risk, lateral movement risk, and a second-chance scenario where the attacker can return after the first encryption attempt is interrupted. In practice, the most dangerous condition is not the payload itself, but the trust relationship that remains usable after the payload fails.
Failure mechanism: The attacker keeps valid access through a stolen password, token, key, or session while defenders focus on process-level blocking. They can then pivot to another system, wait for a quieter window, or trigger encryption again from a different entry point.
Impact: Containment becomes partial rather than decisive, which increases the likelihood of repeat compromise, wider blast radius, and delayed recovery. It also raises the chance that the same adversary can exfiltrate data, reestablish persistence, or stage a fresh ransomware run after the initial response is complete.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-02 — Secret Leakage | Stolen secrets often enable repeat intrusion and later encryption attempts. |
| NHI-07 — Long-Lived Secrets | Long-lived credentials keep an intruder able to return after initial disruption. | |
| Recommendation — Contain leaked secrets immediately and rotate any credential that could still authenticate. Shorten credential lifetime and revoke reusable secrets before focusing on payload blocking. | ||
| CIS Controls v8 | CIS-5 — Account Management | Account control is central when containment must stop reused identity access. |
| Recommendation — Revoke compromised accounts and disable any access paths the attacker can reuse. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Credential lifecycle management is essential when authentication material is the attacker path. |
| Recommendation — Rotate or revoke the compromised authenticator before treating the incident as contained. | ||
| MITRE ATT&CK | T1078 — Valid Accounts | The question centers on attackers reusing legitimate credentials after initial access. |
| Recommendation — Hunt for valid-account abuse and cut off reused credentials across the environment. | ||
Practitioner Guidance
What to prioritise: Treat valid credentials, tokens, and sessions as the primary containment target when the intrusion path is still open. If the attacker can still authenticate, the response is incomplete even if encryption was interrupted.
Decision rule: If the compromise involves reusable identity material, revoke or rotate it before you spend effort on preventing the next file-encryption action. If the compromise is clearly isolated to a non-reusable process artifact, host containment may be enough, but that is the exception rather than the default.
What to verify: Confirm that the compromised credential cannot be reused from another host, automation path, or integration. Also verify that any dependent service accounts, API keys, or sessions that inherited the same trust chain have been addressed.
Practitioner takeaway: The best ransomware defence is not merely stopping one encryptor, it is removing the attacker’s ability to come back with the same identity path.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 23, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org