Fail-closed: device blocks all traffic if it fails — maximizes security, risks availability.
Fail-open: device passes all traffic if it fails — maintains availability, risks security.
Security-critical devices (IPS, firewalls) should fail-closed. Availability-critical devices may need to fail-open. IDS should fail-open (it's passive). IPS decision depends on environment risk tolerance.