Could immediate disconnection destroy visibility of the attacker?¶

Yes. Ending connectivity may terminate the sessions, command channels and network traffic that reveal current attacker activity, even though the operator can continue through another route.

What visibility may be lost¶

Live screens, processes, memory, sessions, addresses, ports and commands can change or disappear on isolation. Endpoint activity may vanish while central monitoring continues, or all useful traffic may stop. Preserve the visible state and relevant security, packet and network records before action where continuing harm permits.

Loss of visibility is not evidence that the attacker stopped. They may switch accounts, hosts or channels, and evidence of the earlier activity may survive only in central logs, providers and affected devices.

Balance observation against damage¶

Continuing serious harm must not be tolerated merely to gather more evidence. A controlled or partial isolation can sometimes restrict harmful communication while retaining monitoring, but that requires specialist network and incident-response judgement.

If immediate disconnection is unavoidable, record the risk, expected evidential loss, systems left online and what could not be captured. Preserve remaining sources promptly and keep conclusions about containment narrow.