SEP has no HIPS. The only thing it monitors are file hashes and asks you on launch if it’s safe when they changed. But, it’s the only free HIDS that I know of. Not sure if it’s actually useful for a typical user as that uses more ressources. Their FAQ also stated that it’s not really suitable for > 1Gb connections. Anyway, it’s a good choice and is very lightweight. The only drawbacks if that it can’t auto update.