I agree that having multi-layer security and keeping the system monitored is very important. For example, even APT attacks and zero-day attacks can easily be protected against through patching and employee education.