Root-cause analysis is the process of finding the original weakness or action that let an intrusion begin. In cyber security, that means tracing beyond the visible malware or suspicious account to identify the first entry point, such as a stolen credential, exposed service, phishing, or an unpatched system.
It matters because removing one payload does not stop an attacker from returning if the same path still exists. During incident response, analysts review authentication logs, endpoint telemetry, network activity, and configuration changes to reconstruct how access was gained and whether persistence was added. Good root-cause analysis turns cleanup into prevention: it helps defenders close the gap, remove re-entry options, and strengthen controls so the same attack chain cannot be reused.