How do you stage one simultaneous containment cut across three regions against an intruder holding two footholds?

## Why simultaneity is the whole design An adversary with two homes — say an implant in the edge VPN appliance's firmware and a dormant inbox rule in the mail platform — is only contained when both go at once. Cutting one first does not halve the problem; it converts a covert investigation into an open contest, gives them a surviving channel and hands them the information about which one you found. So the containment is designed as a single event with a defined start, not as a series of improvements. ## Before T-0 **Enumerate to the point of a decision.** You will never be certain the list is complete. What you need is a defensible statement: here are the footholds we have found, here is the telemetry we have swept for others, here is what we would expect to see if a third exists. Enumeration has a stopping rule, and the stopping rule is usually the loss rate — when damage accruing per hour exceeds what another day of hunting is likely to buy, you stop and cut. **Build the cut list.** One row per action. Each row carries: the target, the exact step (a command, a console action, an API call) that has been tested somewhere safe, the person who will run it, what it depends on, how it will be verified in the first minute, and what to do if it fails. The list is the artefact the whole operation runs from and it should be readable by someone who was not in the planning. **Pre-position everything the cut will break.** This is the step most often missed. If you are taking the VPN appliance offline, you cannot manage it over the VPN — you need console or out-of-band access proven working beforehand. If identity changes are part of the cut, someone must hold break-glass credentials that are not affected by them. Replacement appliances or firmware images should be staged in each region already. And you should not be staging any of this inside a system the adversary can read. **Freeze the estate.** Ordinary change during the window makes verification impossible: you will not be able to tell whether the anomaly at T+10 is the adversary or a routine deployment. Pause non-essential change and tell the change owners as much as they need to know. **Capture before you destroy.** Your own remediation is destructive. Reflashing or replacing the appliance takes its volatile state with it; deleting the inbox rule removes the live object; rebuilding a host removes the only copy of an implant. Decide per item what is captured first — appliance configuration and running state, an export of the mail audit records covering the rule's life, disk or memory images where they matter — and treat that capture as a numbered row in the cut list, not an afterthought. ## At T-0 **One clock.** Announce a single time in UTC and count down to it. Three regions means three sets of hands, and the aim is that every row executes inside a window of a few minutes, not a sequence that walks around the world over an afternoon. **Order inside the window matters less than the window itself,** but there is still a sensible order: kill the adversary's access paths and the identities together, then remove persistence, then verify. Do not leave identity revocation for after the network cut simply because it is harder to coordinate. **Verify each row, not the operation.** Each owner confirms their own step landed — the appliance is off the network, the rule is gone, the credential no longer authenticates — and reports it. An unverified row is a row that did not happen. **Have an abort.** Define, in advance, what makes you stop mid-cut: a destructive reaction that changes the priority to recovery, or discovery of a foothold in something the cut would not touch. Without a stated abort, the decision is made under stress by whoever is loudest. ## After the cut Expect a reaction in the final minutes and immediately after: a burst of exfiltration, an attempt to re-enter through a path you did not know about, or nothing at all. Measure what you can — volume out during the window, authentication attempts against the revoked identities, connections to the removed channel — because those attempts are the clearest evidence of what they still had. Then the watch begins, and containment is not eradication: persistence removal and the argument that no path back remains are separate work. ## The failure everyone has seen One region misses T-0. The wrong instinct is to halt everything and reschedule, which leaves two regions cut and one live — the worst of both worlds, since the adversary now knows and still has a home. The right call is to proceed, isolate the failed region at the network boundary as a blunt substitute, and treat it as compromised until its rows are complete.