Interdiction is the act of stopping illicit movement before it reaches the next destination or market. In cyber security, the same idea applies when defenders block malware, stolen data, or command-and-control traffic before it can be delivered, sold, or used. It is an early disruption strategy: catch the activity at the network edge, at a gateway, or in transit, rather than waiting for a full compromise.
Interdiction matters because many attacks depend on movement. Threat actors need payloads to reach victims, credentials to reach login systems, and exfiltrated data to leave the environment. Defenders use interdiction through mail filtering, web proxy blocking, domain sinkholing, firewall rules, threat intel feeds, and coordinated takedowns. In incident response, successful interdiction can stop ransomware delivery, break phishing campaigns, or prevent data theft from crossing out of a monitored network.