Evicting a so called Advanced Attacker from your network is really hard. It is hard to analyze, it can be hard to understand, and it definitely is hard to figure out when the right time to respond is, and how to respond. But if you're part of an incident response team these are challenges you will face often. This talk is about how you can understand the attacker better, and how you can structure your thinking when deciding how to respond to severe incidents.