What is an Intrusion Prevention System (IPS)?

What is an Intrusion Prevention System?

An Intrusion Prevention System (IPS) is a network security technology that monitors traffic in real time and automatically blocks detected threats before they can cause harm. Where a passive monitoring system observes and alerts, an IPS sits directly in the traffic flow and acts – terminating connections, dropping malicious packets, and triggering responses without waiting for human intervention.

IPS is typically deployed as part of a next-generation firewall or Firewall as a Service (FWaaS) platform, where it works alongside deep packet inspection, application control, and other security capabilities under a unified management layer.

How does an IPS work?

An IPS operates inline with network traffic, meaning all data passes through the system before reaching its destination. This positioning is what enables immediate response: the IPS examines each packet as it flows, identifies threats, and acts before the traffic continues.

The analysis covers packet content, behaviour patterns, and protocol activity. When a threat is identified, the system responds automatically – blocking the specific packets, terminating the session, or updating firewall rules to prevent further traffic from the same source. This happens at network speed, without introducing meaningful latency into legitimate traffic.

Inline deployment means the IPS must balance accuracy with performance. False positives – blocking legitimate traffic – are operationally disruptive. False negatives – missing genuine threats – are a security failure. Both require the detection logic to be well-tuned and regularly updated.

Detection methods

• Signature-based detection uses a database of known threat patterns to identify malicious activity. When traffic matches a known signature – an exploit pattern, a specific malware variant, or a known attack sequence – the IPS blocks it. Signature-based detection is precise and fast for known threats, but depends on signatures being kept current.

Within signature-based detection, two approaches serve different purposes. Exploit-facing signatures target specific attack methods and malware behaviour. Vulnerability-facing signatures protect against attacks targeting known weaknesses in systems or applications, providing broader coverage against variant attacks on the same vulnerability.

• Anomaly-based detection establishes a baseline of normal network behaviour and flags significant deviations. This approach can identify zero-day attacks and advanced persistent threats that have no known signature, because it looks at what traffic is doing rather than what it matches. It requires time to build an accurate baseline and tuning to reduce false positives, but it addresses a class of threats that signature-only systems cannot.
• Policy-based detection enforces organisational security rules automatically. Any activity that violates a defined policy – a protocol used inappropriately, data moving to an unauthorised destination, an application behaving outside its expected parameters – is blocked regardless of whether a specific threat signature matches. This approach supports regulatory compliance enforcement and is particularly useful for regulated organisations with defined information security standards.

Types of IPS

A network-based IPS (NIPS) monitors traffic across an entire network segment. It is typically deployed at perimeter points, between network segments, or in front of data centres – wherever broad visibility and protection across many systems is needed.

A host-based IPS (HIPS) operates on individual endpoints, monitoring all traffic to and from a specific device. This provides granular, device-level protection and can detect insider threats or compromised accounts that might not be visible at the network level.

Network Behaviour Analysis (NBA) systems focus on traffic flows and communication patterns rather than packet content. They are particularly effective at detecting distributed denial-of-service activity, command-and-control communications, and data exfiltration patterns that manifest at the flow level.

Wireless IPS (WIPS) specialises in wireless network protocols, protecting against rogue access points, unauthorised device connections, and attacks that exploit wireless-specific vulnerabilities.

IPS compared to related technologies

• IPS vs IDS. An Intrusion Detection System (IDS) monitors and alerts; an IPS monitors and acts. Both have a role – IDS generates visibility and forensic data, IPS provides real-time blocking. Many organisations use both, as they serve complementary functions. The IDS piece on this site covers the detection side in more detail.
• IPS vs firewall. A firewall controls traffic based on network-level attributes: IP addresses, ports, and protocols. An IPS performs content-aware inspection and behavioural analysis, identifying threats that pass conventional firewall rules. Modern next-generation firewalls integrate IPS functionality, so the distinction is increasingly architectural rather than between separate appliances.
• IPS vs NGFW. A next-generation firewall combines conventional firewall controls with IPS, deep packet inspection, application control, and often additional security capabilities in one platform. In practice, IPS delivered through an NGFW or FWaaS is how most organisations access the capability – as an integrated component rather than a standalone product.

IPS in regulated environments

For regulated organisations, IPS capability serves two functions simultaneously: active threat blocking and evidence generation. The logs produced by an IPS – what was blocked, when, from where, and on what basis – are the audit trail that CAF, DSPT, and NIS2 assessors expect to see. Organisations that can demonstrate continuous, automated threat blocking with a clean record of what was detected and how it was handled are in a considerably stronger compliance position than those relying on reactive, manually assembled evidence.

This is why IPS configuration and the quality of detection logic matters as much as the presence of the capability. A poorly tuned IPS with high false-positive rates disrupts operations. A well-managed IPS that is regularly updated against current threat signatures, with anomaly baselines that reflect the actual network, provides both protection and the evidence that demonstrates it.

How Cloud Gateway delivers IPS

IPS is delivered as part of Cloud Gateway’s Managed Firewall capability, within the Protect pillar of the platform. Signature databases and anomaly models are maintained by the managed service, with updates applied continuously rather than depending on the customer’s team to manage the update cycle. Detection logs are available through the platform for compliance evidence and incident investigation.

For more on how IPS fits within the broader managed security estate, see our Managed Firewall page and our platform page.