IPS

An IPS sits inline on the network and actively blocks traffic that matches attack signatures or malicious behavior, rather than just alerting like an IDS. SOC teams tune IPS rules to stop known exploits automatically while avoiding false positives that break legitimate traffic. It matters because it stops routine attacks at machine speed before a human ever sees them.