HIPS

Host software that detects and actively blocks malicious activity.

A host based intrusion prevention system extends host detection by actively blocking or terminating malicious activity such as suspicious process injection or unauthorized configuration changes. Sitting inline on the endpoint, it can stop an attack rather than merely log it, which is its core difference from a HIDS. It matters as a layer of defense in depth on servers and workstations. A pitfall is aggressive tuning: overly strict rules can break legitimate software, so prevention modes are often piloted in detection only first.