Enterprise security platforms clearly need the ability to prevent and detect intrusions—which we’ll succinctly define here as unwanted software execution or unwanted human activity on an enterprise device or network. Intrusion Detection Systems (IDS) provide the ability to detect, log, and alert on suspicious activity, and Intrusion Prevention Systems (IPS) add the ability to respond, by blocking or terminating the activity in some way. Intrusion Detection and Prevention Systems (IDPS) typically rely on signatures (pattern matching) and/or anomaly-detection mechanisms (often using statistical analysis or machine learning) to identify unwanted activity. They also often integrate with threat intelligence systems, in order to obtain updated data to inform their algorithms. These solutions are commonly available as both standalone solutions, as well as within many Next-Generation Firewalls (NGFWs).