Containment isolates egress from compromised hosts while the forensic image or memory capture workflow still depends on an outbound escrow service during a staged decommission

The incident is contained and the evidence pipeline quietly breaks. The service still works through the primary path, but one dependency only fails when the old component is finally drained away.