Key ID functions include monitoring and analyzing all users' activities, checking system configurations, tracking user policy violations, recognizing attacks if possible, and analyzing abnormal activity patterns. These operations don't differentiate between internal and external users. The first security precaution is to keep your software current with the latest patches and fixes. Hackers try the easy ways first, just like car thieves look for unlocked cars. Plug the obvious holes, and hackers may keep going.
Hackers go for the easy score, but software tracks each and every attack on the bogus weakness.
Imagine luring burglars to a large pile of cash on the counter, only to have a trapdoor swallow them when they touch the money. After closing the known holes, monitor your system to ensure unknown holes don't have a neon Welcome sign. Delete users no longer with the company. Force decent passwords onto users. Even the largest companies have trouble.