You are confident an executive laptop is compromised and they are in the middle of a board meeting. What do you do?

Match containment to the evidence, and escalate the business decision rather than making it alone. If there are signs of active hands on keyboard activity, credential theft or staging, isolate now and inform the incident commander, because a short interruption costs less than a domain wide compromise. If the activity looks dormant, apply partial containment (block command and control, revoke sessions, force credential reset) and schedule full isolation.

My threshold is evidence of active operator activity or credential access. If I see interactive command execution, credential dumping or data being staged, I isolate now and apologize later, because the gap between a compromised laptop and a compromised domain can be ten minutes. I would not just yank it silently though. I call the incident commander, give the evidence in one sentence and my recommendation, and let them make the business call while I stage the action so it can happen the second they say go. If it looks dormant, say a beacon that has not checked in for hours, I take the middle path: sinkhole the command and control domain, revoke the account sessions and refresh tokens, block the process hash, and keep full telemetry on the host so I can watch it. Then isolate when the meeting ends. For the conversation itself I go through the executive assistant with a short factual line and no jargon, because a panicking executive in a board meeting helps nobody.