I think the idea is that after you get compromised, you do forensics to address the vulnerability that exposed you, then after addressing the fixes in your peri

I think the idea is that after you get compromised, you do forensics to address the vulnerability that exposed you, then after addressing the fixes in your perimeter, you reset the compromised systems. The attacker wouldn't be able to hammer you again without having another vulnerability in that case