Eradication
Eradication removes the attacker's foothold from the estate: malware deleted, persistence removed, credentials rotated and vulnerable systems fixed. It follows containment. A platform that only contains has not eradicated, and any report that blurs the two overstates what was actually done.
Definition
Eradication takes longer than containment and needs more certainty about the full scope. Acting too early can tip off an attacker who still has other access.
Many response platforms document containment actions and few document eradication steps. Ask which of the two a vendor's action list actually covers.
Eradication in ServiceNow Security Operations's documentation
ServiceNow docs, found in a search result and not opened, say closure notes are drafted from the containment and remediation activities recorded on the incident, which treats the two as separate recorded phases. vendor claim servicenow.com, read
The example names a vendor and its own page. A vendor's use of Eradication may differ from the definition above; the rubric uses the definition on this page.