Those are best practices in hardening a system but those are just table stakes. Good security requires having observability of your systems and following up and

Those are best practices in hardening a system but those are just table stakes. Good security requires having observability of your systems and following up and/or checking on any anomalous activity you detect. For the most part determined actors (many of them state sponsored) are going to be hard to prevent if they target you. Your best defense is early detection and reaction to the initial breaches. If you only do the hardening part and leave out the monitoring/observation part you are going to get owned.