People are looking to replace their firewall, or add in-line antivirus, or are looking to add intrusion prevention systems. They typically deploy with one or two services activated, and slowly migrate to new features.