What does IDS stand for?
IDS stands for Intrusion Detection System. A system that monitors traffic or activity and alerts on suspected attacks without blocking them. It is passive, usually fed by a copy of the traffic.
An IDS inspects traffic or host activity and raises an alert when it sees something suspicious. It works out of band, usually on a copy of the traffic, so it cannot stop anything by itself. Detection is signature-based, which matches known patterns, or anomaly-based, which flags departures from normal behaviour. A network IDS watches a segment; a host IDS watches one machine.
IDS in practice: an example
A switch mirrors the traffic of the server VLAN to an IDS sensor. The sensor sees a known exploit pattern aimed at a web server and sends an alert to the SIEM. The exploit still reaches the server, because the sensor only received a copy of the packets.
What IDS is confused with
IDS vs IPS: what is the difference?
An IDS detects and alerts. An IPS sits in the traffic path and can drop the packets. Wrong detections cost you an alert on an IDS and blocked business traffic on an IPS. What IPS stands for
Which exams cover IDS?
IDS is on the official CompTIA acronym list for three of the four exams covered here.
- Security+ SY0-801: 4.1 (Security Operations).
- CySA+ CS0-004: on the acronym list, not tied to one objective.
- Network+ N10-009: 1.0 (Networking Concepts).
Each number is a CompTIA exam objective and the name in brackets is its domain. The exam puts the term in a scenario; it does not ask you to recite the expansion.
Check yourself: two practice questions
Written by CertSprint for this page. They are not taken from any exam.
1. A company wants to detect attacks on a legacy production network without any risk of interrupting traffic. What should it deploy?
- An inline IPS
- An IDS on a mirrored port
- A proxy that terminates every connection
- A second default gateway
Show the answer
B. An IDS on a mirrored port. A sensor on a mirrored port only receives copies of packets, so it cannot break the traffic. Inline devices can.
2. An IDS never alerts on a brand-new exploit, although it alerts reliably on old ones. Which detection method is it most likely using?
- Signature-based
- Anomaly-based
- Behaviour baselining
- Heuristic sandboxing
Show the answer
A. Signature-based. Signatures only match what is already known. Anomaly-based detection can flag new attacks because it looks for unusual behaviour instead.
Sources: NIST glossary: intrusion detection system; NIST SP 800-94, Guide to Intrusion Detection and Prevention Systems. The acronym and its expansion come from CompTIA's official acronym lists, linked from each exam glossary above. The explanation, example and questions are CertSprint's own, checked against these sources on 11 November 2026.