Microsoft Defender Now Automatically Isolates Compromised Devices to Stop Ransomware Spread

Cybersecuritynews •Guru Baran • May 26, 2026

Microsoft Defender for Endpoint has introduced automatic device isolation, a proactive containment capability that disconnects compromised workstations from the network the moment a high-confidence attack is detected without waiting for human intervention. Microsoft Defender for Endpoint can now automatically isolate compromised devices as part of its broader Automatic Attack Disruption framework. When the platform identifies […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Microsoft Defender Introduces Automatic Isolation for Compromised Devices Microsoft has launched a new feature in Defender for Endpoint that automatically isolates compromised devices to prevent lateral movement by attackers. This capability, currently in preview, disconnects affected endpoints from the network while maintaining monitoring connectivity. The automatic isolation feature is part of the Automatic Attack Disruption framework, which aims to contain attacks and provide security teams with additional response time. This functionality is limited to onboarded end-user workstations managed by Microsoft Defender for Endpoint. Security operators can release isolated devices after risk mitigation and investigation. Previous enhancements included manual containment for unmanaged devices and isolation support for Linux systems. The feature is designed to help mitigate risks such as data exfiltration and ransomware propagation. Microsoft has also been testing additional features to enhance network security further. 8 sources 43

Microsoft Defender Now Automatically Isolates Compromised Devices to Stop Ransomware Spread

The full story

Extracted Entities

Attack Types (1)

Platforms (1)