Skip to main content
Cyber Risk Council
Category: Incident Response

Eradication

Also known as: Eradication phase, Threat eradication
Simply put

Eradication is the step in responding to a cybersecurity incident where the organization removes the cause of the problem from its systems, such as deleting malware, closing off the attacker's access, and fixing the weaknesses that were exploited. It typically follows containment (stopping the incident from spreading) and comes before recovery (returning systems to normal operation). The goal is to make sure the threat is fully gone so it cannot cause the same harm again.

Formal definition

In incident response, eradication is the activity of eliminating the components of an incident from affected environments after containment and before recovery. It commonly includes removing malicious code and artifacts, disabling or removing compromised accounts and unauthorized access paths, and remediating the vulnerabilities or misconfigurations that enabled the compromise. Eradication is generally a hands-on operational task performed by incident response, security operations, or IT teams; it typically falls outside the direct execution scope of a virtual or fractional CISO, whose role is usually to advise on and govern the response process rather than perform the technical removal. The completeness of eradication depends on the accuracy of prior investigation and scoping, since threats missed during analysis may persist and lead to recurrence.

Why it matters

Eradication is the point in incident response where an organization actually removes the root cause of a compromise rather than simply limiting its spread. If eradication is incomplete, the same threat can resurface, allowing an attacker to regain access or malware to reactivate. This makes eradication a pivotal step: the difference between an incident that is truly resolved and one that quietly persists often comes down to how thoroughly this phase is executed.

The effectiveness of eradication depends heavily on the quality of the investigation and scoping that precede it. If prior analysis misses a compromised account, a secondary implant, or an unpatched vulnerability, those overlooked elements can survive the eradication effort and lead to recurrence. In practice, this means eradication is only as good as the detection and analysis work that informs it, which is why organizations treat scoping accuracy as a prerequisite rather than an afterthought.

For security leadership, eradication also illustrates the boundary between hands-on operational work and governance. A virtual or fractional CISO typically does not perform the technical removal of malware or the closing of attacker access paths; instead, they advise on and govern the response process, ensuring the organization has a defined approach, adequate resources, and appropriate oversight so that eradication is carried out completely and consistently.

Who it's relevant to

Incident Response and Security Operations Teams
These teams typically execute eradication directly, removing malicious code and artifacts, disabling compromised accounts, closing unauthorized access paths, and remediating exploited vulnerabilities. Their work depends on accurate investigation and scoping, since anything missed during analysis can survive eradication and cause the incident to recur.
IT Teams
IT teams often participate in the hands-on removal and remediation work, such as patching vulnerabilities, correcting misconfigurations, and rebuilding or cleaning affected systems, in coordination with security operations before recovery begins.
Virtual and Fractional CISOs
A virtual or fractional CISO usually advises on and governs the response process rather than performing the technical removal. Their role centers on ensuring the organization has a defined eradication approach, that scoping is thorough enough to prevent recurrence, and that the transition from containment to recovery is handled with appropriate oversight. The direct execution of eradication typically falls outside their scope unless explicitly contracted.
Organizational Leadership and Officers
Because eradication determines whether a threat is truly removed before systems return to normal operation, leaders responsible for organizational risk have an interest in confirming the phase is completed thoroughly. Accountability for the outcome of security decisions generally remains with the client organization and its officers, even when technical work is delegated to internal or external responders.

Inside Eradication

Malware and artifact removal
Deleting malicious code, scripts, scheduled tasks, and other attacker-created artifacts from affected systems so they no longer execute or persist in the environment.
Account and credential remediation
Disabling, deleting, or resetting compromised accounts and credentials to remove attacker access paths established during the incident.
Vulnerability remediation
Identifying and closing the exploited weaknesses, such as unpatched software or misconfigurations, that allowed the incident to occur, to reduce the chance of immediate reoccurrence.
System rebuild or reimaging
Rebuilding or reimaging compromised hosts where cleaning cannot be reliably trusted, restoring them to a known-good state before recovery.
Root-cause and scope confirmation
Using forensic analysis to confirm the full extent of compromise and the underlying cause, so that eradication addresses every affected component rather than only visible symptoms.

Common questions

Answers to the questions practitioners most commonly ask about Eradication.

Does a virtual CISO personally perform eradication during an incident?
Typically no. Eradication is a hands-on operational activity within incident response, such as removing malware, deleting attacker artifacts, disabling compromised accounts, and closing exploited vulnerabilities. A virtual CISO generally provides strategy, governance, and executive-level guidance rather than executing these technical tasks. In many engagements a vCISO helps direct and coordinate the response, advises on decisions, and ensures the eradication step aligns with the broader incident-response plan, while the actual remediation is carried out by internal responders, a managed security service provider, or a specialized incident-response firm. Treating the vCISO as the party who cleans systems conflates advisory security leadership with operational execution, unless hands-on work is explicitly contracted.
Is eradication the same as containment, or does one replace the other?
They are distinct, sequential phases and neither replaces the other. Containment focuses on limiting the spread and impact of an incident, often through temporary measures such as isolating affected hosts or blocking traffic, so the situation does not worsen while responders work. Eradication follows and focuses on removing the root cause and the attacker's presence from the environment. Skipping thorough eradication after containment risks leaving persistence mechanisms or vulnerabilities that allow the adversary to return, which is why the two steps are treated separately in standard incident-response models.
How does an organization confirm that eradication was actually complete?
Confirmation typically involves verifying that identified malware, unauthorized accounts, backdoors, and other attacker artifacts have been removed, and that exploited vulnerabilities or misconfigurations have been remediated. This may include scanning affected systems, reviewing logs for signs of persistence, validating that indicators of compromise no longer appear, and cross-checking against the scope defined during earlier analysis. Completeness often depends on the quality of the initial investigation; if the full extent of compromise was not identified, eradication may be incomplete. A virtual CISO can help ensure verification criteria are defined and that the organization does not declare eradication finished prematurely.
What determines whether systems should be cleaned or rebuilt during eradication?
This decision often depends on the severity and depth of the compromise, the criticality of the system, and confidence that all malicious components can be removed. In many cases, rebuilding from known-good sources or trusted backups is preferred over cleaning in place, because it reduces the risk of leaving hidden persistence mechanisms. Cleaning may be acceptable for well-understood, limited infections, but for systems with deep or uncertain compromise, restoration or reimaging is frequently the more reliable path. The choice may vary by organization and should be guided by the incident-response plan and available forensic evidence.
How does eradication connect to the recovery phase that follows?
Eradication generally precedes recovery and sets the conditions for it. Once the root cause and attacker presence are removed, recovery focuses on restoring systems to normal operation, monitoring for signs of recurrence, and validating that services function as expected. If eradication is rushed or incomplete, recovery efforts may reintroduce compromised components or allow the attacker to regain access. Coordinating these phases, ensuring eradication criteria are met before recovery begins, and confirming enhanced monitoring is in place during the transition are areas where security leadership adds value.
What organizational factors affect how effectively eradication can be carried out?
Effectiveness often depends on the thoroughness of prior detection and analysis, the availability of accurate asset and system inventories, access to reliable backups, the maturity of the incident-response process, and cooperation across technical and business stakeholders. Limited visibility into the environment or an incomplete understanding of the incident scope can leave residual attacker footholds. Clear ownership of remediation tasks and defined criteria for declaring eradication complete also matter. A virtual CISO can help strengthen these preconditions through governance and planning, though the outcome still depends on organizational readiness and the capabilities of the responders executing the work.

Common misconceptions

Containment and eradication are the same thing, so once an incident is contained the response is essentially over.
Containment stops an incident from spreading, while eradication removes the cause and traces of it. In NIST SP 800-61, these are distinct considerations; skipping thorough eradication can leave persistence mechanisms or unpatched vulnerabilities that allow the attacker to return.
A virtual CISO personally performs eradication tasks such as removing malware or reimaging systems.
A virtual CISO typically advises on and directs eradication strategy and decision criteria at a governance level. Hands-on operational execution such as reimaging hosts or administering tools is generally out of scope unless explicitly contracted, and the work is usually carried out by internal responders or a contracted operational team.
Once eradication is complete the organization is guaranteed to be free of the threat and safe from recurrence.
Eradication reduces the likelihood of immediate reoccurrence by removing artifacts and remediating root causes, but no engagement can guarantee complete removal or prevent all future compromise. Effectiveness depends on the accuracy of root-cause analysis, the thoroughness of scope identification, and client cooperation.

Best practices

Complete containment and sufficient root-cause analysis before beginning eradication, so that removal actions address the full scope of compromise rather than only visible symptoms.
Treat eradication as iterative, verifying that persistence mechanisms and attacker footholds are gone before moving on to recovery.
Remediate the exploited vulnerabilities and misconfigurations, not just the malware, to reduce the chance of the same incident recurring.
Reimage or rebuild systems to a known-good state where cleaning cannot be reliably trusted, rather than assuming a compromised host is clean.
Clearly define in the engagement scope which eradication activities the security leader advises on versus which are executed operationally, and confirm that accountability for decisions remains with the client organization.
Coordinate eradication decisions with business stakeholders, since choices about rebuilds, timing, and acceptable residual risk carry operational and business consequences.