A method of examining a subject data word (410; 410A - 410H), the subject data word (410; 410A - 410H) comprising a plurality of subject-data blocks, and identifying a full match between the subject data word (410; 410A - 410H) and a signature data pattern (510; 510A - 510H), the signature data pattern (510; 510A - 510H) comprising a plurality of signature-data blocks (1116A -1116D), wherein each of the subject-data blocks and each of the signature-data blocks (1116A -1116D) has (i) a respective value and (ii) a respective position, the method carried out by an intrusion-prevention system (IPS, 112) comprising at least one processor, at least one network interface, partial-match hardware having at least part of the signature data pattern (510; 510A - 510H) stored therein, and full-match hardware having the signature data pattern (510; 510A - 510H) stored therein, the method comprising: the IPS receiving the subject data word (410; 410A - 410H) via the at least one network interface; the IPS making a partial-match determination comprising a determination that a partial-match number of the subject-data blocks respectively match the same partial-match number of the signature-data blocks (1116A -1116D) stored in the partial-match hardware with respect to both value and position, wherein the partial-match number is (i) greater than or equal to two and (ii) less than a total number of the subject-data blocks; subsequent to making the partial-match determination, the IPS making a full-match determination comprising a determination that all of the subject-data blocks respectively match all of the signature-data blocks (1116A - 1116D) stored in the full-match hardware with respect to both value and position; and the IPS storing a full-match indicator, the full-match indicator indicating that the full-match determination has been made; characterized in that the signature-data blocks (1116A - 1116D) stored in the partial-match hardware are stored in a memory block that begins at a partial-match address in the partial-match hardware; wherein making the partial-match determination comprises using at least part of the subject data word (410; 410A - 410H) to determine a partial-match-subject-hash result corresponding to the partial-match address. the IPS receiving the subject data word (410; 410A - 410H) via the at least one network interface; the IPS making a partial-match determination comprising a determination that a partial-match number of the subject-data blocks respectively match the same partial-match number of the signature-data blocks (1116A -1116D) stored in the partial-match hardware with respect to both value and position, wherein the partial-match number is (i) greater than or equal to two and (ii) less than a total number of the subject-data blocks; subsequent to making the partial-match determination, the IPS making a full-match determination comprising a determination that all of the subject-data blocks respectively match all of the signature-data blocks (1116A - 1116D) stored in the full-match hardware with respect to both value and position; and the IPS storing a full-match indicator, the full-match indicator indicating that the full-match determination has been made; characterized in that the signature-data blocks (1116A - 1116D) stored in the partial-match hardware are stored in a memory block that begins at a partial-match address in the partial-match hardware; wherein making the partial-match determination comprises using at least part of the subject data word (410; 410A - 410H) to determine a partial-match-subject-hash result corresponding to the partial-match address.