An Intrusion Prevention System (IPS) is a security control that inspects network traffic in real time, matches it against threat signatures, behavior rules, or policy conditions, and blocks traffic that looks malicious. Unlike a passive detector, an IPS can drop packets, reset sessions, or quarantine flows before they reach an internal host.
IPS matters because many attacks still rely on recognizable patterns such as exploit payloads, command-and-control beacons, brute-force attempts, and protocol abuse. In practice, defenders place IPS inline at network boundaries, inside data centers, or in cloud-delivered firewall services to reduce exposure without relying only on endpoint tools. Effective IPS tuning is important: too strict, and it can disrupt legitimate traffic; too loose, and attacks pass through. Modern IPS deployments often combine signatures with context from identity, application, and TLS inspection so they can enforce policy in layered environments.