An intrusion prevention system (IPS) is a network security control that sits directly in the path of traffic, inspects it for attacks, and blocks malicious traffic automatically. It is the active counterpart to an intrusion detection system (IDS): where an IDS raises an alert, an IPS can drop the packet or reset the connection before the attack reaches its target. Today an IPS is most commonly a feature of a next-generation firewall or a cloud-delivered security service rather than a separate appliance.
At a glance
- An IPS is inline: all traffic passes through it, so it can block in real time.
- It detects attacks using signatures of known exploits, protocol checks and behavior analysis.
- It can shield unpatched systems from known exploits (“virtual patching”) while you schedule updates.
- Because it blocks, poor tuning can disrupt legitimate traffic, so testing and tuning matter.
- It is usually bought as part of a firewall, UTM, FWaaS or SASE platform.
What problem it solves
Firewalls decide who can talk to whom, but the traffic they allow can still carry an exploit, such as a malicious request aimed at a vulnerable web server or VPN appliance. Patching every system immediately isn’t realistic; some systems can’t be patched for weeks, and some can’t be patched at all.
An IPS closes part of that gap. It inspects allowed traffic and stops attacks that match known exploit patterns or clearly malicious behavior, without waiting for a person to read an alert. That is especially valuable for internet-facing systems, where scanning and exploitation of newly published vulnerabilities can begin within days, and for older systems that can no longer be updated.
How it works
Placement. An IPS sits inline, typically at the internet edge, between internal network segments, or in a cloud security service that your traffic is routed through. Because traffic must pass through it, its throughput and reliability affect the network directly. Many appliances support a fail-open mode so traffic keeps flowing if the IPS fails, which trades protection for availability.
Detection. Signature rules match known exploits and malware communication. Protocol analysis flags traffic that doesn’t follow the rules of the protocol it claims to be. Some products add behavior analysis and threat intelligence feeds, such as lists of known malicious addresses.
Action. For each rule, the IPS can alert only, drop the offending packets, reset the connection or block the source for a period. Rules are usually grouped into profiles tuned to what you’re protecting, such as web servers or user traffic.
Encrypted traffic. To inspect encrypted content, traffic must be decrypted, usually by the same firewall or service. Policies typically exempt categories such as banking or health sites for privacy reasons, and some applications break when decrypted.
Tuning and updates. Vendors update signatures continuously as new vulnerabilities appear. Your team or provider tunes which rules block, which only alert, and which are off, based on what you run.
When it matters for buyers
- When choosing a firewall or SASE platform. IPS quality, update speed and the performance impact of turning it on vary by vendor and model; firewall throughput figures with IPS enabled are often far lower than headline numbers.
- When you run internet-facing systems. Public web apps, VPNs and remote access gateways are prime targets.
- When patching lags. Virtual patching is a practical stopgap for systems you can’t update quickly.
- When compliance requires it. Some frameworks and customer contracts ask for intrusion detection or prevention on sensitive networks.
Questions to ask vendors
- What is the throughput with IPS and decryption enabled, not just the headline firewall number?
- How quickly do you release signatures for newly disclosed, actively exploited vulnerabilities?
- Is the IPS subscription included or a separate annual license?
- Can we run rules in detect-only mode first, and how easy is tuning?
- What happens to traffic if the IPS fails or is overloaded?
- How are blocked events logged, and can they be sent to our SIEM or MDR provider?
- If it’s a managed service, who tunes the rules and how fast do they respond to false positives?
How it differs from an IDS
An intrusion detection system (IDS) watches a copy of traffic and raises alerts; it typically cannot stop an attack by itself, and a passive network IDS doesn’t directly block production traffic. An IPS sits in the traffic path and blocks automatically, which stops attacks faster but carries the risk of blocking legitimate traffic. Most network firewalls, UTM appliances and firewall as a service (FWaaS) offerings include both, so you choose per rule whether to detect or prevent. See our intrusion detection and prevention systems overview.
Problems this helps with
- Attacks on unpatched systems we can't update quickly
- Exploit attempts getting through the firewall
- Compliance requirement for intrusion prevention
- Worried that automatic blocking will break business applications
