CMDashCybersecurity Maturity Dashboard

← All landscape areas

Network Security · Core

IDS / IPS

Detects and blocks malicious network traffic.

8 options listedTypical cost: $0-$80k/yrDETECT (DE) / PROTECT (PR)

Overview

Intrusion detection/prevention inspects traffic against signatures and behavioral rules to flag or drop attacks. Often delivered as an NGFW module rather than standalone today. Open-source engines remain widely used for sensors and research. Tuning and rule curation are the real operating costs.

Adds detection depth; usually bundled into NGFW rather than bought standalone.

Advantages

High-value detection layer
Suricata/Snort/Zeek are powerful and free
frequently included in NGFW at no extra hardware cost.

Trade-offs

Signature-based engines miss novel attacks
heavy tuning to control false positives
standalone deployments increasingly redundant vs NGFW/NDR.

Vendors & tools in this area

Cisco Secure IPSCommercial

Cisco's security line (firewall, workload, email, etc.).

Palo AltoCommercial

Broad leader: NGFW, Prisma cloud/SASE, Cortex XDR; premium platform.

TrellixCommercial

XDR/endpoint from the McAfee Enterprise + FireEye merger.

SnortOpen source

Classic open IPS (Cisco-backed).

SuricataOpen source

High-performance open IDS/IPS/NSM.

ZeekOpen source

Network security monitoring framework (ex-Bro).

Trend Micro TippingPointCommercial

Dedicated inline IPS appliance line backed by Trend's Zero Day Initiative research.

Corelight (IDS, Suricata-based)Commercial

Hardened, supported appliance/sensor layer built on the open-source Suricata engine.

Start free trial Browse the full atlas

IDS / IPS — Cybersecurity Landscape Atlas — CMDash