Techniques are disclosed for preventing malicious attacks or other exploits on a computer server. A network manager may be configured to determine a topology of a plurality of network devices and deploy an intrusion prevention system in one or more of the network devices to mitigate attacks against the vulnerable servers. The one or more network devices may be identified based on the topology and one or more constraints for optimizing the deployment of the intrusion prevention systems.