Yes and no. Logging is getting better and can be shipped off-site. Additionally, they would usually have to crack multiple passwords, to gain the access needed

Yes and no. Logging is getting better and can be shipped off-site. Additionally, they would usually have to crack multiple passwords, to gain the access needed to all the devices that log. The firewall, for example, should NOT be Radius and should local auth, so if someone gains AD creds, they don't have access to the firewall, too. In IT there are 1000s of ways to skin a specific cat, and everyone has their own, so I'm not touting mine as "The way". I'm simply stating that "cleaning up logging" isn't as simple as it sounds, when it really comes down to it.