Make containment decisions before scope is known, reasoning in reversible-versus-irreversible moves — because acting tips off the adversary (they burn down, accelerate, or pivot) while not acting lets the bleed continue, and "we don't fully understand it yet" must never quietly become "so we did nothing." Use in an active incident when the question is what to do now with incomplete information: "should we isolate the host", "pull it off the network", "rotate all credentials", "rebuild or watch", "will we tip them off", "we don't know the full scope yet", "contain now or gather more". Sibling of assume-breach-modeling (for blast radius under uncertainty) and irreversible-a…
