Intrusion detection provides the benefit of watching internal users as well as external. Just as most retail goods disappear out the back door rather than the front, most security breaches come from within. Key ID functions include monitoring and analyzing all users' activities, checking system configurations, tracking user policy violations, recognizing attacks if possible, and analyzing abnormal activity patterns. These operations don't differentiate between internal and external users. The first security precaution is to keep your software current with the latest patches and fixes.
Hackers try the easy ways first, just like car thieves look for unlocked cars.
Plug the obvious holes, and hackers may keep going. Hackers go for the easy score, but software tracks each and every attack on the bogus weakness. Imagine luring burglars to a large pile of cash on the counter, only to have a trapdoor swallow them when they touch the money. After closing the known holes, monitor your system to ensure unknown holes don't have a neon Welcome sign. Delete users no longer with the company.