I'm glad I am not doing sysadmin for anyone but myself these days, the tools and knowledge needed to handle this level of mass intrusion available to common sys

I'm glad I am not doing sysadmin for anyone but myself these days, the tools and knowledge needed to handle this level of mass intrusion available to common sysadmins is abysmal. By the way, has anyone heard anything in the leaks about HIDS exploits? Right now I am leaning towards the position that if "everything is comprimised", the key to security in the future is primarily in log notifications and other auditing measures. I saw some stuff about deleting windows event logs, but if for example the server was running a hids that syslogged to a central log server, or even an encrypted decentralized log server, they would have to comprimise the entire system to prevent the log from existing. Security is about layers.