Endpoint protection that can cut an infected laptop off the network remotely in one step

Look for EDR with “remote device isolation” or “network containment.” That’s the feature that lets an authorized admin isolate an infected laptop from the network from a management console—usually with a single action—while keeping the security agent connected for investigation.

Options that offer it include:

• Microsoft Defender for Endpoint — choose Isolate device in the Defender portal. The laptop is cut off from ordinary network traffic but retains a connection to Defender; isolation can also be automatic in some attack-disruption scenarios. (learn.microsoft.com)
• CrowdStrike Falcon — provides host containment through its response capabilities. (developer.crowdstrike.com)
• SentinelOne Singularity — supports isolating devices, including automatic isolation in some cases. (sentinelone.com)

If you already use Microsoft 365, Defender for Endpoint is a natural first option to evaluate. Check licensing and test the isolation action on your laptop types and VPN setup: isolation behavior and prerequisites vary, and an offline laptop can’t receive the command until it reconnects. (learn.microsoft.com)

Several EDR platforms have a one-click network isolation action. The main options from my search:

• CrowdStrike Falcon: Its EDR can contain an endpoint, cutting it off from network activity. The device can still talk to the CrowdStrike cloud, and the containment persists through reboots and cloud disconnects. CrowdStrike EDR can isolate the endpoint, which is called "network containment." It allows organizations to take swift and instantaneous action by isolating potentially compromised hosts from all network activity.
• Microsoft Defender for Endpoint: Its "Isolate device" action is one of the named EDR isolation features. Endpoint isolation is a one-click response action exposed by modern EDR platforms (CrowdStrike Real Time Response, Microsoft Defender for Endpoint 'Isolate device', SentinelOne Network Isolation, Carbon Black Cb Live Response, Cortex XDR). One source also notes it offers customizable isolation policies.
• SentinelOne Singularity Endpoint: It combines EPP and EDR, and analysts can instantly isolate a compromised host and terminate malicious processes across the network with a single action.
• Palo Alto Cortex XDR: It is listed among platforms that support isolation as a response action, and it adds cross-layer correlation with network and firewall data.
• Acronis Cyber Protect with EDR: It offers endpoint isolation alongside process termination and quarantine, with backup and recovery in the same agent.
• Sophos Intercept X with XDR: The source I found lists it among top EDR tools but didn't confirm its isolation details, so check its documentation.
• Trellix EDRF: Its client version 50.3 added a unified isolation workflow across Windows, Linux, and macOS, and it keeps administrative connectivity open during isolation.

Things to check before buying:

• Licensing tier: Isolation is often included only in higher tiers, and some vendors restrict selective isolation to specific products. One managed-detection vendor, for example, offers full isolation for all its supported EDRs but selective isolation only for Microsoft Defender. Confirm the feature is in the plan you're pricing.
• Offline laptops: Some platforms queue the isolation request and apply it when the laptop next connects, which matters for a laptop that's off-network.
• Management channel: Isolation normally leaves the EDR management channel open so responders can keep investigating. Confirm that's how the product behaves.

To cut an infected laptop off the network remotely in one step, you need an Endpoint Detection and Response (EDR) solution. These platforms are specifically designed to provide "one-click" or "automated" network isolation.

How It Works

When you trigger isolation from the EDR management console, the agent installed on the laptop instantly restricts the device's network traffic.

• Containment: The laptop is blocked from communicating with internal network resources (preventing lateral movement) and usually from accessing the internet (stopping data exfiltration/C2 communication).
• Persistent Management Channel: Crucially, the device maintains a secure, limited connection to the EDR platform. This allows your security team to continue running forensic investigations, collecting logs, or performing remediation without needing physical access to the device.
• Reversibility: Once the threat is cleared, the administrator can restore network access with another single click.

Leading EDR Solutions with This Capability

Most enterprise-grade EDR platforms support this feature. Common options include:

• Microsoft Defender for Endpoint: Offers a robust "Isolate device" action within the Microsoft 365 Defender portal. It also supports "Attack Disruption," which can trigger this isolation automatically.
• CrowdStrike Falcon: Known for its "network containment" feature, which can be triggered instantly to block all network activity while preserving the management link.
• SentinelOne Singularity: Provides one-click network isolation and is highly regarded for its autonomous response capabilities, which can include automatic rollback of malicious changes.
• Other Notable Solutions: Platforms like Cynet, Sophos (XDR), and Broadcom (Carbon Black) also include similar one-step network isolation features as part of their incident response toolkits.

Important Considerations

• Automation vs. Manual: While most platforms support manual one-click isolation, many also allow you to configure automated policies. For example, if the EDR detects ransomware, it can automatically isolate the device to prevent the spread before a human analyst even sees the alert.
• Testing: Before relying on this, it is highly recommended to test the isolation policy in your environment. You want to ensure that while the device is isolated, your security team’s remote access or monitoring tools are explicitly excluded from the block list so you don't lose the ability to manage the device.

Microsoft Defender for Endpoint is a strong fit. In its portal, an administrator can open the laptop’s device page, choose Isolate device, then confirm. The laptop is cut off from ordinary network traffic while retaining the connection needed to the Defender service. ¹

Other products with similar remote containment include CrowdStrike Falcon, which can network-contain a host while allowing connections to CrowdStrike and any administrator-approved local IPs, ¹³ and Palo Alto Cortex XDR, which can isolate an endpoint while preserving access to Cortex XDR. ¹⁵

Practical caveat: these actions require the endpoint to be enrolled and communicating with the security service; check VPN and connectivity requirements before relying on isolation during an incident. Microsoft notes, for example, that a full-tunnel VPN can prevent an isolated device from reaching Defender’s service. ⁴