Great article, summarized succinctly. I agree that you can't rely singularly on an outer shell if the boundaries how we work with customers and colleagues nowadays are blurred. I'm certainly not the first to point out there is no magic force field to guarantee data security. It does seem frighteningly inevitable when you see the resources available to these attackers so my thoughts are thus: Accept the real and imminent risk of attack and then take the time to review how you would react to such an attack to minimize the impact. I believe you can only really do this by leveraging investments in both your company's security and network equipment to provide event information centrally for analysis to track behavioral patterns. This then allows for immediate and accurate reaction to any attack to minimize impact.