Methods and systems are provided for using lambda transitions for processing regular expressions in intrusion-prevention systems. In an embodiment, a state-transition table is provided, said table being representative of a predetermined data pattern, and including states having egress events defining transitions to other states. A subject is received for evaluation for the presence of the predetermined data pattern. While using the state-transition table for said evaluation, a first state is transitioned into, the first state having an egress event defining a transition to a second state, a state count corresponding to a number of times the first state has been transitioned into, a state-count threshold, and a state-count condition. After transitioning into the first state, the state count is incremented. Responsive to determining that the state-count condition is satisfied by comparing the incremented state count with the state-count threshold, the transition to the second state is taken.