IPS

An IPS sits inline on the network and actively blocks traffic that matches attack signatures or malicious behavior, rather than just alerting like an IDS. This stops routine attacks at machine speed before a human ever sees them. SOC teams tune IPS rules to stop known exploits automatically while avoiding false positives that break legitimate traffic.