I was just studying about firewalls and IDS/IPS and had a doubt. Are these the only two major security devices that a company invests in? or are there other equipment and security controls?
There are few other choices. If software is inherently insecure, all you can do is to replace it with something that isn't; or wrap it up in a condom of some sort. Host-based systems require programs to be invasively, and cooperatively, installed on every client (virus scanners, local network stack IPS). Network-based systems don't require cooperation from the clients, and try to fix security by parsing traffic. Some network-based systems require a little bit of cooperation by blocking encrypted traffic for connections that don't submit to scrutiny; and accept the company/ISP's certificate authority (so that the authority at the local boundary can inspect the traffic).