Adversary disruption means deliberate actions that interfere with a threat actor’s operations, tools, or infrastructure. In cyber security, this can include seizing domains, sinkholing command-and-control servers, blocking malicious accounts, disabling phishing pages, or forcing attackers to rebuild their systems. The goal is not always to arrest an attacker immediately; it is often to slow them down, break coordination, and reduce the impact of ongoing campaigns.
This matters because many intrusions depend on reliable infrastructure and repeatable workflows. If defenders can disrupt those assets, they can interrupt malware delivery, stop data theft, and buy time for victims to contain damage. In practice, adversary disruption sits between intelligence and response: teams collect indicators, map infrastructure, and act with law enforcement, cloud providers, or registrars. It is a common defense strategy against ransomware, phishing, botnets, and espionage operations.