I partially disagree to this post. What the author wants is unrealistic and their understanding of detections isn't ideal. I assume they know that a SIEM doesn

I partially disagree to this post. What the author wants is unrealistic and their understanding of detections isn't ideal. I assume they know that a SIEM doesn't need agents. But an EDR does. EDR can be a well configured auditd/sysmon and a response agent. Or you pay up and get a "nobody gets fired for buying crowdstrike". One reality is that APT hacks are out of scope for most orgs. Another reality is that for at least a decade and a half the security industry has accepted that prevention is not a good strategy against APTs. This is why you need that other EDR agent and SIEM. You focus your detection on what the threar actors do after compromise and around your important data. For most APTs this is effective but it is far from perfect. The biggest problem is people like the author who are not seeing actual compromises happen all the time. Security costs money and it can only cost as much as the risk tolerance of the company. It can't cost so much that the company's profit margins take a beating for example. That's why NIST recommendations are important, so execs can say we are spending enough. Another side of prevention is that it needs to be as invisible as possible. If users notice it or it gets in their way, by default it is bad, you have to do things to compensate for the deteriorated user experience. You can add MFA for example but better make up for it by making it a yubikey and doing SSO. Keep in mind that corporate networks are a hodge-podge patchwork of random things pieced together over time. Threat actors need one mistake to abuse. And the P in APTs mean they'll try until they find the mistake, it's their day job quite literally lol.