What Is Intrusion Prevention System (IPS)?

An intrusion prevention system inspects traffic in line and blocks what matches known attack patterns or deviates from expected protocol behaviour. Being in line is the distinguishing property and the source of both its value and its risk: it can stop an attack in progress, and it can stop legitimate traffic.

That asymmetry drives how these are deployed in practice. A false negative is an attack missed; a false positive is an outage.

Detection-first is the sensible sequence

Almost every successful deployment begins in detection mode, with signatures tuned against real traffic for weeks before anything is set to block. The tuning removes rules irrelevant to your estate and identifies the legitimate applications that trigger signatures.

Moving to blocking should then be selective: enable prevention for high-confidence signatures covering exploits against systems you actually run, and leave the remainder alerting. A device blocking on its full default signature set will eventually break something important, and the response is usually to disable blocking entirely.

Where it genuinely helps

Virtual patching is the strongest case. When a vulnerability is disclosed in something you cannot patch quickly — an appliance, a vendor application, a system in a change freeze — a targeted signature holds the specific exploit closed while the fix is arranged.

It is also effective against opportunistic scanning and automated exploitation, which is a large share of internet background noise and occasionally the thing that finds an exposed system you had forgotten.

Where it does not reach

Encrypted traffic it cannot inspect. Attacks using legitimate credentials, which look like authorised activity. Novel techniques with no signature. And anything that never crosses the point where the device sits — which, in a flat internal network, is most lateral movement.

Tuning is continuous, not a deployment task

Signature sets update frequently, and every update introduces rules that may not suit your estate. A device tuned carefully at deployment and never revisited drifts back toward noise within a year.

The sustainable pattern is a short periodic review: which signatures fired most, which were false positives, which protect systems you no longer run. Disabling irrelevant rules improves both performance and the signal-to-noise ratio of what remains.

Where nobody owns that review, the predictable outcome is that alerts are ignored wholesale — at which point the device is providing a compliance artefact rather than a control.

Where it sits relative to decryption also matters. A device inspecting traffic before TLS termination sees very little, and one inspecting afterwards sees everything but may sit behind a load balancer that obscures the original client. Establishing what the device actually observes, rather than what the diagram implies, is worth doing once and documenting.

A common mistake worth avoiding

Where to start

Find out whether your system is blocking or only alerting, and how recently its signatures were tuned. Devices left in detection mode indefinitely, feeding a log nobody reads, are common enough to be worth checking.

See network security. GuardsArm delivers managed security.