The whole point of those systems is catching actual behaviours, not patching/firewalling per se (though they do some level of permission management on some plat

The whole point of those systems is catching actual behaviours, not patching/firewalling per se (though they do some level of permission management on some platforms). For example, patching nginx is not going to help if your user gets phished of an suth token that was explicitly supposed to let them run code on the server - bit catching that the code started browsing files elsewhere and sending data out will help you notice the breach.