100% detection is very impressive and the detection time is great too... but when I've used IDS myself in the past, the problem has been the false positives. 0.33% sounds like a small number, but it's actually pretty huge... and funnily enough the reason it's huge comes down to your point about measuring the right things. What we really want to see is the ratio of false positives to true positives. So e.g. if we got a score of 50%, that means for every two real threats detected we get a false positive. And if that was the measure, 0.33% would mean a negligible false positive rate. But the measurement reported is actually the percentage of all valid traffic that has false detections. Since valud network traffic vastly outweighs threat traffic this means the ratio is in fact huge i.e. the vast majority of threat reports generated by the system will in fact be false. In my experience this cripples the true effectiveness of IDS. Sadly, users just get used to ignoring what it is telling them. The solution to this is to have a dedicated team going through the logs, who are trained to search for the needles in the haystack regardless of the amount of hay coming their way. I guess it's a service that Cisco can offer as an add on? But this puts the TCO way up, which makes the offering less attractive to the market. Just my two pence worth.