This thesis compares two different approaches to an intrusion detection system (IDS), a centralized IDS (CIDS) and decentralized IDS (DIDS) in a zero trust architecture (ZTA), with the aim of identifying the preferred approach to use in enterprise networks. The research objectives used to find the result are advantages and disadvantages, vulnerabilities and threats, performance, scalability as well as criteria for the approaches.The method being used is a matrix based literature review, which both identifies and comparesthe research objectives for each approach. Each risk and each feature has a big difference in importance. Various criteria are measured and analyzed in the study, to find a well researched outcome.The outcome finds that there is no clear answer to which approach is better. Meanwhile the analysis found that the preferred approach is based on the most relevant criteria for the type of enterprise network. This study intends to provide help for enterprise networks in selecting themost appropriate approach for an IDS [1].Furthermore, this study emphasizes the importance of organizations being well informed when deciding on a preferred approach.