You are responsible for network security at a defense contractor. You are very concerned about sensitive data not getting out of your network. You have specific concerns about employees or…

An Intrusion Detection System performs deep traffic analysis across all network flows and can identify suspicious outbound patterns - such as FTP exfiltration or covert spyware callbacks - even on ports that are nominally allowed, generating alerts that give security personnel visibility into potential data leakage attempts that firewalls and anti-spyware alone cannot catch.

A DMZ firewall segments public-facing services from the internal network to limit inbound attack surface, but does not monitor or restrict authorized internal users or spyware from sending data outbound.

Blocking all external email is operationally disruptive and overly broad; it does not address exfiltration via FTP, HTTP, DNS tunneling, or other channels already noted as concerns.

Network-wide anti-virus targets known malware signatures and helps prevent infection, but does not provide real-time monitoring of network traffic flows to detect unauthorized data transfers in progress.