How quarantine works
Security tools place items in quarantine when they match a threat signature, show suspicious behaviour or fail a policy check. A file is moved to a protected location and disabled, an email is held back from the inbox, and an endpoint can be cut off from the network except for management traffic.
Administrators or analysts then review the item. They can delete it, restore a false positive, or submit it for deeper analysis. Logs record who handled the item and when, which is useful for investigations.
Why it matters for Canadian organizations
Fast containment limits how far an incident can spread. Isolating an infected laptop quickly can prevent ransomware from reaching file shares, and holding a phishing email prevents a user from clicking at all.
Quarantine records also help organizations demonstrate controls and document response steps, which supports breach assessments under PIPEDA and Law 25. Poorly managed quarantine, however, can hide legitimate business email or files, so review processes matter. Quarantine actions should be logged so analysts can review who released or deleted items.
How to implement it
Enable quarantine in email security, endpoint protection and network access control, and set clear policies about what is quarantined automatically. Restrict who can release items and require review for high-risk detections.
Define response playbooks for isolating compromised devices, including who can authorize it and how to restore access. Monitor quarantine queues, tune rules to limit false positives, and keep users informed about how to request a release. Combine isolation with investigation, since removing one file rarely explains how it arrived.
Frequently asked questions
What does quarantine mean in antivirus software?
It means a detected suspicious file is moved to a secure, isolated location where it cannot run or spread. You can later delete it permanently or restore it if it was a false positive. You can usually restore it if it proves to be a false positive.
Is quarantine the same as deleting a file?
No. Quarantined files are kept in a locked state for review and can be restored. Deletion removes them permanently. Quarantine is safer when unsure whether a detection is accurate. Deleting is permanent, whereas quarantine preserves the item for analysis.
Can quarantined items still infect my system?
Not while properly isolated, since they cannot execute. The risk arises if they are restored without verification, so release items only after confirming they are safe. Verify first with a security team or a trusted analysis service.
Related service: Email security