We're starting to turn on IPS and Behavior detection features for endpoint and server customers. You'll see a new "Detect malicious behavior" option in threat protection policies.
You can test both of these features now in the Early Access Program; otherwise Sophos will manage the enablement in small batches of customers over the next few months.
Regards,
Stephen
