Depending on its design, prevention may drop packets, reset a connection, rate-limit traffic, block an address or account, quarantine a host, or prevent a local action.
A network IPS is commonly placed inline so traffic passes through its enforcement path, while host-based prevention acts at the protected system. Some deployments use an off-path detector to request enforcement elsewhere. Because blocking changes live communications, policy must define confidence thresholds, exemptions, response duration, failure behavior, and a rapid way to reverse harmful decisions.
Key points
Detection basisUse signatures, protocol validation, behavioral or anomaly methods, reputation, and contextual evidence appropriate to the traffic and assets being protected.
Enforcement designDetermine which actions are local or delegated, how long blocks last, whether state is shared, and what happens during overload, sensor failure, maintenance, or lost control-plane connectivity.
Safe operationTune and test in the real environment, stage high-impact rules, monitor false positives and bypasses, preserve evidence, and use site-specific safety and change control for operational technology.
Important limitationAn IPS cannot prevent what it cannot observe or recognize. Encryption, unsupported protocols, evasions, alternate paths, and novel behavior can cause misses, while an incorrect block can disrupt legitimate or safety-critical service.