During containment, the focus is on preventing the incident from causing further damage. Steps may include:
- Isolating affected systems to prevent the spread of malware or unauthorized access. - Disabling compromised accounts and changing passwords. - Applying patches or updates to vulnerable systems.