Acts like a security guard for the network. Usually sits inline with network traffic, evaluating it in real time to respond to threats coming in to the network, and auto blocks the traffic
Similar to IDS