Attackers will find and exploit flaws in the software, figure out ways to bypass the technologies, or social engineer their way through them. The only way to maintain security is through detection and response. Keeping the watch I've come to believe that this requires a managed security monitoring service. The vast majority of organizations cannot provide detection and response within their own IT departments. And the reason is vigilance.
Vigilance means continuousness.
Guard services offer 24-hour protection. Security-alarm monitoring companies don't go home for the weekends, and it can't be any different in the digital world. Attackers follow their own schedules. Attacks often happen at inconvenient times. Criminal hacking follows the academic year.