Abstract: Detecting intrusions into computer systems is the process of monitoring events that occur in a computer system or network and analyzing them for possible incidents that violate or threaten to violate computer security policies, accepted user policies, or standard security practices. Intrusion prevention is the process of detecting an intrusion and trying to stop the detected incidents. Intrusion detection and prevention systems are mainly focused on: identification of possible incidents; registration of information about them; an attempt to stop them; passing them to security administrators. This article will cover guidelines for choosing IDPS products for organizations. First, the general requirements that IDPS products must meet will be discussed. Next, a set of criteria will be considered to estimate the four main aspects of IDPS technologies: security capabilities, performance, management and life cycle cost. At the end of the article, the principles of practical product evaluations will be outlined and in which cases each of the evaluation methods is most appropriate. This article assumes that the organization has already determined what type of IDPS technology is needed — network, wireless, network behavior analysis (NBA) or host-based. Organizations can use these criteria as a basis for creating a specific set of criteria that takes into account the environment, organization policies, and existing security and network infrastructure. After collecting the requirements and selecting the criteria, evaluators should find relevant sources of information about the products to be evaluated. Common sources of product data include testing laboratories or real-life product use practices, vendor information, thirdparty product reviews, and previous IDPS experience from individuals in the organization and agents of other organizations.