Containment vs Eradication
Stopping an attacker's ongoing access versus removing their foothold entirely — sequential phases with different urgency and different risks of doing them wrong.
Containment limits further damage now: isolate affected hosts, revoke credentials and sessions, block egress destinations, disable compromised accounts. Fast, and it should not wait for full understanding.
Eradication removes the attacker's presence: the initial access vector, any persistence mechanisms — scheduled tasks, additional accounts, modified images, planted keys — and anything else established during dwell.
The sequencing errors are both common. Eradicating before containing lets the attacker observe the response and adapt while still having access. Containing without preserving evidence — reimaging a host immediately — destroys the information needed to determine what was accessed, which is exactly what a breach notification requires.
The judgement that has to be made early: isolate immediately, or observe to learn scope? Isolating stops the damage and may leave persistence undiscovered elsewhere. Observing risks further loss. There is no general answer, which is why it should be decided by a named person with authority rather than debated during the incident.
The architectural enablers matter here: the ability to isolate a workload without taking the service down (segmentation), to revoke all credentials quickly (short-lived credentials and workload identity), and to determine what was accessed (tamper-evident audit logs with sufficient retention). Each of those is a design decision made long before.