A user clicked a link in an email, and now the cursor is moving around on its own. A technician notices that File Explorer is open and data is being copied from the local drive to an unknown cloud…

Investigating the reported symptoms is important, but it should happen after the immediate threat of spread or further damage has been contained by quarantining the device.

Running anti-malware software is part of the eradication phase, which comes after containment to remove the threat, not as the initial response when active data copying is observed.

Educating the user about dangerous links is a crucial preventative and post-incident measure, but it does not address the immediate, active security incident unfolding on the workstation.

Quarantining the workstation by disconnecting it from the network is the critical first step in incident response to prevent the malware from spreading to other systems and to stop further data exfiltration from the compromised machine.