You're doing it wrong

Marcus Ranum - if you've never heard of this guy, you need to check him out. He has a no-nonsense stance towards security and like me, doesn't believe you need to know intricate details about every 0-day exploit to be able to defend a network against intruders. His stance towards security is very "design based", as in you can't skip any steps, and you have to start at the bottom. You can't "add" security on top of an existing gong-show and expect it to be effective. Companies waste money every day with this approach, and security vendors are reaping the benefits.