A network security system for a network, the network comprising a plurality of networked appliances, the security system comprising one or more security devices, wherein each security device of the one or more security devices is associated with one or more networked security appliances of the plurality of networked security appliances, and wherein each security device comprises: a network interface comprising one or more ports, wherein each networked security appliance of the one or more networked security appliances associated with the security device is operatively coupled with the security device via a different port of the ports; at least one processor configured to: upon initial setup of said security device, create a baseline profile of an activity of the network, and following an activation of a protection mode, identify an irregular event by detecting a deviation of network traffic passing through a port of the ports from said baseline profile.