First of all, this is probably a better question for the Threat Prevention space.
Second, Ransomware such as RedBoot is really a great example of why you need multiple layers of protection.
While IPS, Anti-Virus, and Anti-Bot are great technologies, they are not enough to stop Ransomware.
Any number of things could potentially deliver the RedBoot payload to a customer--things which could surely be blocked by AV if it's a known variant.
However, it's trivial to make any known variant unknown, reducing the efficacy of AV.
Since there's no "phone home" element to this ransomware/wiper, Anti-Bot or IPS wouldn't see anything.
If the payload is delivered as a Microsoft Office or PDF doc (which is fairly common), then Threat Emulation would surely catch it.
Threat Extraction would strip out these unsafe elements so the end user would never see them.
If on the off chance Threat Emulation/Extraction didn't catch it, then Check Point's AntiRansomware on the endpoint would stop it and quickly undo the damage.
