Enterprise security departments have typically been presented with one of two options: either the use of unified threat management systems (UTMs) to achieve a unified perimeter or an IDS solution that can offer greater insight into network activity. However, when considering solutions for enterprise environments running on Microsoft Windows-based products, it appears that both sides are focusing on the wrong issue. The argument from UTM vendors, who market their product as the "one-stop shop" for IT personnel with limited time resources, is that a UTM device provides all necessary functions (firewall, VPN, antivirus, etc.) within a single unit. On the other hand, the vendors of specialized IDS devices argue that the inclusion of these additional functionalities reduces the effectiveness of the IDS function. As such, organizations providing protection for Windows networks continue to be at increased risk due to this way of thinking.

Cybersecurity engineer Samuel Bemi investigated this gap through a controlled comparative evaluation of Snort, an open-source intrusion detection system, and pfSense, an open-source unified security platform, within a virtualised Windows 11 enterprise environment. His evaluation goes beyond the conventional question of whether a security control detects an attack, examining whether that detection remains operationally valuable once false positives, latency, throughput, and resource utilisation are taken into account.

Detection alone doesn't tell the whole story

The experiment simulated three of the most common attack patterns organisations face: ICMP flood attacks, port and service scanning, and denial-of-service traffic. Both Snort and pfSense were configured to defend a Windows 11 host inside an isolated network built specifically for testing.

The results were clarifying, not comforting. Snort detected 100 percent of ICMP flood attempts and 100 percent of denial-of-service traffic, and identified the large majority of port scanning attempts. Within the controlled test environment, Snort achieved strong detection performance against the traffic patterns tested. But the more important finding was that detection performance came with operational trade-offs.  Alongside that success sat a false positive rate high enough to be operationally significant, alongside a measurable increase in network latency and a meaningful drop in throughput once both systems were active.

Bemi's evaluation shifts the question from “which security control detects more attacks?” to a more consequential one: “does the security architecture remain effective when detection accuracy, false positives, and operational overhead are considered together?”  Rather than assessing IDS and UTM controls independently, Bemi's approach examines how detection accuracy, false positives, resource consumption, and network performance interact when the controls are deployed within the same enterprise environment. This perspective provides security teams with a more practical basis for designing defence-in-depth architectures, where protection is assessed not only by what threats a control detects, but also by how effectively it operates within the wider network.

"A 100 percent detection rate cannot be evaluated in isolation," Bemi says. "If achieving that result introduces significant false positives, latency or throughput degradation, the security control has to be assessed as an operational system rather than simply as a detection mechanism."

What UTM alone Mmisses

Bemi’s argument is that IDS will never replace or outperform UTM. Instead, he says both tools solve two different layers of the same issue. Layer one is Perimeter Enforcement (Firewalling, VPN termination, Traffic Shaping, Blocking Known-Bad traffic) as long as you have the correct settings with your UTM devices such as pfSense. The Layer Two that IDS addresses is what happens after you allow something past the first layer. This Layer two provides a level of detail that can't be replicated by UTM alone. In particular, this was very evident during Bemi's testing and evaluation based on Detection Capability and Operational Impact.

" A UTM determines whether traffic should be admitted into the Network," Bemi states. " An IDS answers a completely different Question; namely, now that it is inside the Network, does it appear to be anomalous?" Bemi stated enterprises who use only UTM are typically making only one determination regarding allowing traffic past the Firewall/VPN termination device. Then they are simply relying on anything that passes through to be safe."

Resource cost is a design input, not an afterthought

One of the study's most important findings is that defence-in-depth is not operationally free. Running both controls increased CPU and memory utilisation and introduced additional network latency, demonstrating that security architecture cannot be evaluated solely through detection effectiveness.

He argues the practical barrier to hybrid defence is often less about whether the controls can work together and more about whether organisations have planned for the capacity, tuning and monitoring they require. "Nobody disputes that defence-in-depth is the right architecture on a whiteboard," he says. "The resistance comes at implementation, when a smaller IT team realises that running both properly means capacity planning, rule tuning to bring false positives down, and ongoing log review. That is a resourcing conversation, not a technology conversation. But skipping it does not remove the risk; it just moves the risk from the network into the business."

The practical path forward

For organisations still treating this as a binary purchasing decision, the practical implication of Bemi's evaluation is not that every organisation should deploy both controls indiscriminately. Instead, security architects should treat UTM and IDS as complementary controls, evaluate their combined performance under realistic traffic conditions, and size infrastructure and monitoring capacity around the resulting operational overhead.

Conclusion

The challenge for Windows enterprise security is not choosing between UTM and IDS, but designing an architecture in which both controls address different layers of the same threat landscape. Bemi’s evaluation demonstrates that detection rates alone do not determine security effectiveness; false positives, latency, throughput, resource consumption, and the effort required to operate the controls also matter. The industry therefore needs to move beyond product-versus-product comparisons and assess how security controls perform together under realistic enterprise conditions. In practice, UTM can provide the first layer of perimeter enforcement, while IDS adds deeper visibility into suspicious activity that may pass through that boundary. Organisations considering a hybrid approach should test the combined architecture against representative workloads and establish clear thresholds for performance, false positives, and resource utilisation before deployment. They should also plan for ongoing rule tuning, monitoring, capacity management, and analyst involvement rather than treating these as secondary operational concerns. Ultimately, effective defence-in-depth depends not simply on deploying more security tools, but on ensuring that complementary controls work together in a way that is measurable, sustainable, and aligned with the organisation’s operational needs.

In this edition: Bad medicine, imperfect sound forever, know when to fold ’em, brainiacs, and a call of the wild.

Scientists are growing miniature human brains in labs around the world. (Yep, you read that right.) For Wired, Claire L. Evans reports on the latest research in the field of organoid intelligence, or OI, where scientists are artificially growing brain organoids from tiny human samples, whether skin, blood, teeth, or even hair. As these seed-sized globs mature, they are able to send and receive electrical signals, and even learn to remember and anticipate them. In other words, this living matter is programmable. “And this is where things get truly weird,” writes Evans.

For now, these neural computers are mostly of interest to researchers who want to work with neurons without taking on the tedious wet-lab husbandry themselves. Eventually, however, the company hopes that neurons will prove themselves to be an energy-efficient, resilient substrate for more general computing applications—including some tasks currently handled by AI, like image recognition and classification.

“When you think about what you want from AI, it’s biology,” said Brett Kagan, Cortical Labs’ chief operating officer, when I reached him over Zoom. “You want it to be self-repairing as much as possible. You want it to be adaptable. You want it to be long-lived. You want it to be energy-efficient. These are all features you get for free in biology.”

Midway through Boyce Upholt’s mind-boggling dispatch, one of his sources sums up the central challenge of the Gulf Coast canid: “Why is there not just a simple explanation for what this thing is?” The “wolfy coyotes” of southeastern Texas hold genetic traces that may link them to red wolves, which were declared extinct in the wild in 1980. But a lack of data makes it challenging to define the species—or, for that matter, to determine whether a private company has cloned the red wolf or something else entirely. Upholt doesn’t deal in simple explanations; the pleasure, here, is in the complexity.

The concept of a “species” is less sturdy than your high school biology teacher might have led you to believe. The most familiar definition is that a species consists of animals that can produce fertile offspring. But that’s a rule various species of canids violate all the time; it’s long been clear that North America’s soup of Canis genes is something less like a family tree and more like a river—one that’s broken by islands and sandbars into many braided channels that split and merge and re-split.

Travis Diehl’s feature on “Star Axis,” the half-century project of artist Charles Ross, is transportive, an ideal combination of explanatory and sensory writing. Not all of us will make it to the sparse section of Anton Chico, New Mexico, to ascend the steps of Ross’s pyramid and see the stars reel. For those of us who don’t, Diehl’s piece makes for an elegant consolation prize.

Ross broke ground during the U.S. Bicentennial year. Fifty years and more than $10 million later, he says “Star Axis” will be done by winter. In the final design, the staircase rises 11 stories through a tunnel blasted in the rock of Chupinas Mesa, 6,000 feet above sea level and into a viewing chamber in a concrete, stone and steel pyramid 52 feet tall. A circular window there frames Polaris. As viewers climb each of the 147 stairs, the rim of the window appears to broaden, giving an idea of how far Polaris has and will move in a given amount of time, during the 26,000-year cycle known as precession, the gravitational wobble of the Earth’s rotational axis.