An average company using an OC-3 or lower can get an acceptable amount of NSM data without breaking the $3000 barrier for a very fast, big-hard-drive 1U box and network tap. With NSM you don’t need to hire a hundred Gulas, Ranums, and Roesches, but with NSM, you know what is happening and can try to improve. The data helps make the expert, not the other way around, and security problems never go away.”]
Source: https://taosecurity.blogspot.com/2007/01/and-another-thing-more-nsm-thoughts.html