Acts like a security guard for the network. Usually sits inline with network traffic, evaluating it in real time to respond to threats coming in to the network, and auto blocks the traffic