Your EDR should be able to quarantine a device at the router

Most estates detect on the endpoint and contain on the network, with a human in between reading an alert. That handoff is where most dwell time actually goes.

The sequence today

An EDR agent flags credential dumping on a laptop. The alert lands in a queue. An analyst picks it up, confirms it, and raises a request with the network team to isolate the host. Best case that is minutes. Realistically, out of hours, it is considerably longer — and lateral movement is measured in seconds.

The sequence it should be

The agent detects, meets a defined confidence threshold, and signals the network access control layer directly. The router moves the device into a quarantine VLAN with access only to remediation services. The analyst picks up an alert about a device that is already contained.

What it requires

• Consistent device identity across endpoint platform, NAC and asset inventory. Without it, the quarantine action cannot reliably resolve a target.
• Network infrastructure that accepts dynamic policy — this is where older estates stall, and it usually means the router work comes first.
• A tested release path. Containment you cannot reverse quickly gets disabled the first time it hits a false positive on an executive's laptop.
• Explicit exclusions. Asset classes that are never auto-isolated: safety systems, clinical devices in active use, production control.

Where it goes wrong

Teams deploy it broadly with aggressive thresholds, hit a disruptive false positive in week two, and switch it off permanently. Start narrow — one asset class, high confidence threshold, business hours only — and widen once the release path has been used in anger.