Does anyone employ active threat countermeasures at your company and if so what do you use?

We use Deception technology at our perimeter and on our internal network.   Perimeter protection works extremely well.  It also takes a considerable load off the firewalls which in turn greatly reduce the logs being generated which leads to reduced expense in logging solutions.  Product is PacketViper

Ips ids in our firewalls

We do not.

We use services from SecureWorks – they have intrusion detection/prevention tools installed at the perimeter of our network and they are integrated into our firewalls and logging at the perimeter too – If they detect a threat or believe there is an exploit happening they can deploy blocking at the firewall and in their intrusion prevention system (blocking on the network). We also use CrowdStrike tools on key endpoints – high risk clients and our servers have their agents deployed.  This is connected to their monitoring service – which can take active steps to stop an incident if needed (taking a compromised client off the network, blocking traffic to other clients, etc.). We do not have any “hack back” tools or techniques deployed, but we do actively respond via a combination of network and client systems and services.

Cisco umbrella, sophos, hardened endpoints.