Nedved is an IT Security Manager of a bank in his country. One day. he found out that there is a security bre ch to his company's email server based on analysis of a suspicious connection from the ema

Leaving the server connected while contacting the IR team allows the attacker to continue the active breach, potentially exfiltrating more sensitive data during the delay.

Blocking the suspicious IP at the firewall is a partial mitigation only - the server itself remains on the network and may have additional backdoors or communicate with other attacker-controlled addresses.

Disconnecting the email server from the network is the containment step in the incident response lifecycle, preventing the attacker from continuing to exfiltrate data or pivot to other systems while the IR team is being engaged. Containment must happen before deeper analysis or remediation to limit the blast radius of the incident.

Migrating traffic to a backup server does nothing to contain the compromised server, which remains active on the network and under attacker control.