2. Verify
Then we check instead of assuming. That means confirming the issue is actually resolved, and that the security controls on the machine are in place and working. Where the question is what happened — how it got in, and what it touched — that is incident response and digital forensics work, and we do both.