I know/get that, so it kinda answers the first question. But then the other one remains, basically for any OS: if signature-based scanners aren't good enough,

I know/get that, so it kinda answers the first question. But then the other one remains, basically for any OS: if signature-based scanners aren't good enough, how do you properly check you are secure? Is something like connection logging sufficient?