You discover an attacker holds valid credentials in your environment. What are your first three actions and what must already exist for them to be possible?

What is being tested

Whether you preserve evidence before remediating, and whether you understand that containment speed is determined by architecture rather than by process.

The first three actions

1. Preserve evidence before changing anything. Snapshot the affected instances — memory if possible, disk certainly — and secure the logs immediately, ideally by copying them somewhere the compromised environment cannot reach.

This is counterintuitive under pressure, and it matters for two reasons: restarting destroys the attacker artefacts needed to determine scope, and scope determination is a legal requirement with a clock — many regimes require notification within 72 hours of awareness. If you cannot say what was accessed, you must assume the worst, which is a materially worse position.

The attacker's own first move is often to delete logs, which is why they must be immutable and stored outside the compromised environment.

2. Contain — revoke the credential and isolate the affected workloads. Not shut everything down; contain. Revoke the specific credentials, rotate anything they could have accessed, and isolate the affected workloads at the network layer so the attacker loses their position without taking the business offline.

3. Determine scope. What did the credential have access to, what did it actually do, and when did it start? This drives everything afterwards: which data is affected, whether notification is required, which other credentials to rotate.

What must already exist

Containment speed is an architectural property, not a process one:

• Short-lived credentials, so revocation is fast and effective. Long-lived shared credentials cannot be revoked quickly without an outage, so containment is delayed for exactly as long as it takes to coordinate a rotation.
• Workload identity rather than shared secrets, so a credential maps to one workload.
• Network segmentation, so isolating a workload does not mean isolating everything.
• Immutable, centralised logs in an account the compromised environment cannot write to, with retention long enough to determine when the intrusion began. Short retention means assuming the worst.
• Egress monitoring and control — exfiltration is what turns an intrusion into a breach, and egress is usually the least controlled path.
• An asset and data inventory, so "which systems held this data" has an answer.
• Immutable infrastructure, so recovery means rebuilding from source rather than cleaning a host to unknown completeness.

Why the ordering matters

The instinct is to restart the compromised instance immediately. That feels like containment and is actually destruction of evidence — it removes the attacker but also removes your ability to say what they did, which is the question you will be asked by regulators, customers and your own board.

What a strong answer adds

Naming the legal clock explicitly, and noting that the security incident process differs from operational incident response in three ways: an adversary is present and may react to your actions, evidence must be preserved, and obligations attach with a deadline. Running a security incident like an outage is a common and expensive mistake.