Eradication is the incident response phase where defenders remove the attacker’s presence from affected systems. That can include deleting malicious tools, removing persistence mechanisms such as services or scheduled tasks, closing backdoors, resetting compromised credentials, and patching the weakness that allowed access in the first place.
Eradication matters because containment alone only limits damage; it does not remove the threat. If any malware, stolen account, or hidden remote access remains, the attacker may return after the incident is declared under control. In real investigations, eradication often follows forensic analysis so teams know exactly what to remove and what to preserve as evidence. Strong eradication work helps ensure recovery is safe and reduces the chance of reinfection, repeated lateral movement, or a second compromise through the same entry point.