The eradication phase is the part of incident response focused on removing the attacker’s presence from the environment after containment. It goes beyond stopping active behavior and includes deleting malicious files, removing tools, and clearing residual components so the compromise cannot be easily reactivated.
What Eradication Means in Incident Response
Eradication is the phase where the response team removes the attacker’s foothold after containment. The goal is not just to stop activity, but to eliminate the tools, persistence mechanisms, malicious artifacts, and other residual components that could let the compromise return.
Because eradication follows containment, it depends on a clear understanding of what was actually present in the environment. If the scope is incomplete, remnants can survive in hosts, credentials, scripts, scheduled tasks, registry changes, cloud resources, or remote access paths.
Why Eradication Is Different from Containment
Containment limits spread and ongoing damage. Eradication addresses the underlying presence that made the compromise possible. That distinction matters because a threat can be contained without being removed, and a hidden backdoor, web shell, or persistent account may remain usable after traffic is blocked.
In practice, eradication often requires deciding whether to clean in place or rebuild affected systems from trusted sources. The more deeply the attacker altered the environment, the more often reimaging, redeployment, or account reset becomes safer than selective deletion.
For response teams, the Incident Response Guide provides the broader incident response lifecycle that places eradication between containment and recovery, while the Incident Scoping and Containment Strategy Guide helps connect containment decisions to the later removal of adversary presence.
What Eradication Typically Removes
Eradication can include deleting malware, removing persistence hooks, clearing temporary staging files, revoking malicious remote access, disabling abused accounts, and removing scheduled or automated execution paths. It may also include neutralising attacker infrastructure that was planted inside the environment, such as tunnels, implants, or modified scripts.
The exact action depends on what the investigation found. A commodity infection may be removed with targeted cleanup, but a more advanced intrusion often requires broader elimination of compromised components and trust relationships, especially if the attacker modified multiple systems or reused valid access.
Where identity and access were abused during the intrusion, eradication usually extends into credential reset and session invalidation, because those are often part of the attacker’s working set rather than a separate administrative task.
How Eradication Sets Up Recovery
Recovery is only reliable when eradication has removed the conditions that could reactivate the intrusion. That is why response teams verify that malicious binaries, persistence, stolen tooling, and unauthorized access paths are gone before systems are returned to service.
Good eradication also creates evidence for the post-incident review. What was removed, where it was found, and what had to be rebuilt all inform future hardening, detection tuning, and playbook updates.
In mature incident handling, eradication is therefore both a technical cleanup activity and a decision point that shapes whether recovery is safe, durable, and defensible.
Risk and Threat Considerations
Eradication is where many incidents fail to end cleanly. If the team removes visible malware but misses persistence, stolen credentials, or shadow administrative access, the attacker can re-enter after containment is lifted or systems are restored.
Failure mechanism: Residual artifacts, unauthorized access paths, or compromised trust material survive the cleanup and reestablish attacker control.
Impact: The incident can recur, recovery can be delayed, and the organisation may restore systems that are still unsafe to trust.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | RS.MA-01 — Incident Mitigation | Eradication is the mitigation step that removes an active compromise from the environment. |
| Recommendation — Remove malicious artifacts and attacker footholds before restoring affected services. | ||
| NIST SP 800-53 Rev 5 | SI-4 — System Monitoring | Detection and cleanup of malicious persistence depend on monitoring for compromised system behavior. |
| IR-4 — Incident Handling | Incident handling covers coordinated containment, eradication, and response actions after compromise. | |
| IA-5 — Authenticator Management | Eradication often requires resetting or revoking compromised credentials and sessions. | |
| Recommendation — Use monitoring to confirm malicious behavior and persistence have been eliminated. Apply incident handling procedures to remove the adversary’s presence and document what was eradicated. Revoke or reset compromised authenticators and related credentials during eradication. | ||
| MITRE ATT&CK | T1070 — Indicator Removal on Host | Eradication often includes deleting files and artifacts an attacker uses to persist or evade review. |
| Recommendation — Hunt for indicator-removal activity and verify attacker artifacts were actually removed. | ||
Practitioner Guidance
Why practitioners should care: Eradication is the point where response quality becomes measurable. A fast containment action is not enough if the environment is still contaminated, because the true success criterion is whether the attacker can no longer persist or return.
What to watch for: Recurrent beacons, unexplained scheduled tasks, altered startup paths, unexpected service accounts, and newly created admin-level access are all signals that eradication may be incomplete.
Practitioner takeaway: Treat eradication as a verification problem, not just a cleanup task, and do not move to recovery until you can explain why the attacker’s foothold is gone.
Related resources from NHI Mgmt Group
- How should security teams phase out password-based authentication without disrupting operations?
- How should security teams phase out SMS OTP without breaking access?
- When should teams move from target-phase controls to advanced OT Zero Trust controls?
- How should organisations phase an identity governance programme to reduce risk?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 31, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org