A good percentage of traffic within an organization is encrypted these days. So unless you are expending resources to decrypt the traffic, then full pcap is really limited these days. But since NetFlow does not rely on decrypting traffic, it is often the best place to start an investigation.