Maybe the front door is locked, but the back or side door is open. If so, most corporate networks are probably compromised in some way. People buy tools after the attack, similar to the way they buy firewalls. Worse, there is a skills gap. The rate at which a person can become and stay knowledgeable about security systems and malicious methods pales in comparison to the rate at which the industry is growing.
People have to stay current, and that's tough.
Vendors are also challenged to keep up. Avi Fogel, president and CEO of IDS vendor Network One, says hackers will always be more agile than vendors because hackers don't go through a quality assurance process. Ideally, you could find a more generic tool that prevents classes of intrusion like Trojan horses. Network One is an advocate of intrusion detection at the edge of a network so that the host can see the attacks directed at it. Piers McMahon, senior business manager for the eTrust suite of security products at Computer Associates, agrees that different traffic types must be monitored.