# What does eradication mean in incident response?

Eradication is removing the attacker's presence completely before you bring systems back. It includes deleting malware and tools, closing the way in, removing accounts, scheduled tasks and remote-access software the attacker created, resetting every credential that may have been exposed, and patching the vulnerabilities they used. In practice, rebuilding affected machines from clean images is often more reliable than cleaning them, because it is hard to prove that every change has been found. Eradication fails when it is partial: attackers who keep one foothold come back, sometimes weeks later. It should be planned from the evidence of your investigation, not guessed. Watching the network afterwards tests whether it worked: NetSenX flags renewed beaconing to known or new outside servers and new lateral sessions, on every plan.

FAQ: [Incident response](https://netsenx.com/en/faq/incident) · https://netsenx.com/en/faq/what-does-eradication-mean-in-incident-response

## Read next

- https://netsenx.com/en/detect-ransomware-on-the-network
- https://netsenx.com/en/nis2-incident-reporting-deadlines

## Related questions

- [How do we reset passwords safely after a breach?](https://netsenx.com/en/faq/how-to-reset-passwords-safely-after-a-breach)
- [How do we know the attacker is really gone?](https://netsenx.com/en/faq/how-do-we-know-the-attacker-is-really-gone)
- [Can we keep using our computers after a ransomware attack?](https://netsenx.com/en/faq/can-we-keep-using-computers-after-ransomware)
- [How do we recover safely after a cyber incident?](https://netsenx.com/en/faq/how-to-recover-safely-after-a-cyber-incident)
- [Can we keep working during a cyber incident?](https://netsenx.com/en/faq/can-we-keep-working-during-a-cyber-incident)