Firewalls, while vital forms of protection, do not block all intruders attempting to gain access from outside the network.
Most intrusions are from network insiders.
Whether intruders want to attack a system or steal confidential information, the potential damage makes additional security essential. An IDS recognizes attacks and monitors when someone gains or attempts to gain unauthorized network access. What to Expect First, be aware that an IDS does not solve all security problems. It does not assess and anticipate vulnerabilities in the network so much as monitor those areas of the network that administrators believe are vulnerable. An IDS is only as good as the information human beings provide it.