They implement monitoring controls at leaf nodes of the network—rather than concentrating them at choke points, e.g., routers—in order to distribute the inspection workload and to take advantage of the visibility a system has of its own state.
Instead of placing monitoring controls at critical network points like routers, they are placed at leaf nodes. This approach distributes the inspection workload and utilizes the system's awareness of its own state for better performance.