Network disruption is interference that degrades or blocks normal communication between systems, users, or services. It can be caused by malicious activity, such as ransomware, destructive malware, or attacks on routing and identity infrastructure, but it can also result from defensive containment actions or ordinary technical failures. The visible effect is often the same: users cannot reach applications, authentication fails, and business processes stall.
In cyber security, network disruption matters because it is often the first sign that an incident has moved beyond a single device. Broad interruption can indicate lateral spread, disabled services, or deliberate sabotage. During defense and recovery, teams use logs, traffic data, and change controls to distinguish attacker impact from response actions. Careful restoration is important: bringing systems back too quickly can reintroduce compromise, while delaying too long can extend operational damage.