A system shutdown is the deliberate stopping of computers, servers, or network services as a containment measure. Security teams use it when they suspect malware, ransomware, or active compromise and want to cut off access before the threat spreads, encrypts more files, or destroys evidence.
In cyber security, a shutdown can buy time, but it also reduces availability. Essential services may pause while responders isolate infected hosts, preserve logs, and verify backups. In real attacks, shutdowns may be triggered by ransomware, destructive malware, or emergency incident-response playbooks. Defenders try to make the action selective, shutting down only the affected systems or segments so critical functions can keep running. A shutdown is therefore a trade-off: it can limit damage, but it must be planned so recovery is fast and business impact stays as low as possible.