Device isolation is an endpoint control that removes a machine from normal network communication, usually by blocking outbound and inbound traffic while keeping the device manageable from the security console. The goal is to stop suspicious activity from spreading, reaching command-and-control servers, or contacting other internal systems.
This matters because many attacks move fast after the first foothold. If defenders isolate a host soon after they detect abnormal process behavior, risky network connections, or signs of malware staging, they can contain the incident before a second payload arrives or lateral movement begins. In practice, device isolation is often used in EDR and antivirus tools as a rapid response action: analysts investigate the machine, preserve evidence, and restore access only after the threat is removed and the host is trusted again.