Originally posted here by Synja
So... it gets the malware before it has connected to a vulnerable service?

And it gets it before the download starts?
Right on both accounts, it mostly acts like a "firewall" I suppose, it will detect the threat of a network virus and depending on how you have it set up will either quarantine the malware or shutdown the network connection, or both.