Compare broad and surgical containment patterns and recall when each is stronger.
Choose the pattern Broad containment vs. surgical containment The decision is driven by spread speed, privilege, business criticality, and evidence confidence. Surgical cue When is surgical containment usually stronger? When the abuse path is well scoped, privilege is limited, and the cost of broad disruption is high. Think leaked single-use token, one constrained workstation, or one narrowly understood SaaS session path. Broad cue When is broad containment usually stronger? When privileged access, rapid spread potential, or uncertainty around second-hop exposure is high. Think ransomware, identity-admin compromise, or management-plane access with unclear blast radius. Common trap “Let’s only contain what we…
Sign up free — one personalized lesson every day, matched to your role and goals.
Already have an account? Sign in