A SIEM tool fires an alert about a VPN connection attempt from an unusual location. The incident response team validates that an attacker has installed a remote access tool on a user's laptop while…

Blocking the source IP is a reactive containment measure that does not address the full threat, since the attacker holds valid credentials and can reconnect from any IP address.

Running an antivirus scan is a containment or eradication step focused on a single device, skipping the essential scoping phase needed to understand the full incident impact.

Identifying systems or services at risk is the critical next step because it establishes the blast radius of the incident before containment actions are prioritized. The attacker holds valid credentials and a deployed remote access tool, meaning multiple systems could be targeted - scoping this exposure is required to respond effectively.

Identifying lateral movement is an investigative activity that follows scoping - responders must first know which systems are at risk before tracing attacker movement between them.