Reimaging is the process of wiping a device and reinstalling its operating system from a trusted image. It restores the machine to a known-good state, removing installed software, local persistence mechanisms, and many forms of malware. In enterprise environments, reimaging is a standard recovery step when a workstation or server is believed to be compromised.
In cyber security, reimaging matters because it is often faster and more reliable than trying to clean every trace of an intrusion. Defenders use it after ransomware, remote-access malware, or tampering that may have altered system files. However, it only addresses the device itself: stolen credentials, mailbox compromise, cloud access, and attacker-controlled accounts can survive a rebuild. Before reimaging, teams usually preserve logs and evidence, then rotate passwords, revoke tokens, and verify that the same attacker does not re-enter through another path.