Prevention differs from detection because a prevention control interrupts a suspicious session while a detector only records and alerts.
The difference is the outcome for the session, not a second copy of the same blocking manual under another name.
How it works
A detector can listen to a copy of traffic and still be useful, because its failure does not have to stop the business from communicating.
Prevention needs a position from which forwarding can be refused, so its failure mode and its false accusations land directly on users.
Choose interruption where a wrong stop is tolerable and the harm of letting the session finish is not, such as a known unsafe pattern on a public site.
Choose a notice first where you still need to learn the pattern, or where stopping a legitimate payment would cost more than a delayed investigation.
Concrete examples
- A passive copy of branch traffic feeds alerts all weekend, and shoppers keep paying even while the analysis host is rebooting.
- The same pattern, once trusted, is later moved to an interrupting policy at the data center edge and the sessions stop arriving.
- A team leaves email authentication failures as notices because an interrupting rule was blocking a partner with a broken clock.
Protective measures
- Write down for each rule whether the intended outcome is a notice or an interrupted session, and reject rules that blur the choice.
- Accept interruption only after you have seen the notice stage produce a tolerable false accusation rate.
- Give operations a dashboard that separates stopped sessions from mere notices so an outage is not mistaken for quiet logs.
- Revisit the choice when the business changes, because a pattern that was safe to interrupt last year may now be a critical partner flow.