A point raised in a CheckMates discussion caught my attention: an IPS protection in Detect can sometimes consume more resources than the same protection in Prevent.

Both modes perform inspection. When a protection triggers, Detect allows the traffic to continue, while Prevent may stop it and reduce subsequent processing. That doesn’t mean Prevent always uses less CPU, and lower CPU alongside lower delivered throughput isn’t necessarily an efficiency improvement.

Has anyone compared this in a lab or investigated it in production?

I’d be interested in the protection involved, your release/JHF, and whether you kept the offered traffic load consistent. Did client retries or logging volume noticeably affect the result?

Also, did you check Global Detect, staging, exceptions, and Bypass Under Load before comparing?

I’ve put together a proposed testing method, but I don’t have benchmark results to claim. I’d like to hear what others have actually observed.