This is a follow-up to my post Response for Daily Dave. I call it the Intruder’s Dilemma. Knowing where and when to look, and what to look for becomes the challenge. As the scope of the incident expands to other systems, the probability of discovery increases. So, perversely, the bigger the incident, the more likely someone is going to notice. This point of view can help you argue why you need the visibility to detect and respond to intrusions, even though you can’t prevent them.”]
Source: https://taosecurity.blogspot.com/2009/05/defenders-dilemma-and-intruders-dilemma.html