Suricata is an open-source Intrusion Detection System (IDS) and Intrusion Prevention System (IPS). Its job is to monitor network traffic and identify malicious behaviour. Think of it like a security guard watching every packet of data entering and leaving the network. Suricata can detect: suspicious file transfers command-and-control traffic ransomware communication patterns known malicious IP addresses unusual outbound data transfers In the Kido breach, attackers likely needed to move stolen data outside the network. This is called data exfiltration. Suricata could have identified unusual outbound traffic—such as large encrypted transfers to suspicious external servers—and alerted administrators immediately. If configured with prevention rules, it could even block some of that traffic automatically. This would reduce the amount of stolen information and limit the attackers’ success.