Rothman makes the following comment about IPS:
Personally, I think it’s a pipe dream. The market has voted most IPS blocking off the island, opting instead to block maybe 2-3% of the applicable rules and monitor the rest. What makes us think, that even over a reasonable planning horizon (5-7 years), that detection will become granular and accurate enough to actually do this kind of automated blocking?
When your buddy is slumbering soundly on the couch, he unconsciously moves or swats the fly lightly landing on his cheek. Watching this a couple times leads to the brilliant idea to fill that hand with shaving cream and tickle his cheek so the automatic reaction results in a face full of cream. That’s my analogy on the issue with most IPS rules. I’m not anti-IPS or automatic blocking, but I am anti-dumb-unconscious-blocking which, as Rothman says, only works for a stupidly small set of triggers, yet.