The security industry has largely given up on prevention as a means of stopping breaches, the current trend is very much based on fast detection &amp; response.<p>Neither the NSA&#x27;s nor these systems have the capacity to store full-take data, hell even just netflow data can be a challenge to store for any extended period of time.<p>The only thing that can really be done is streaming monitoring.<p>To the people wondering why decryption is necessary: HTTPS is ubiquitous and ip&#x2F;port info is not actually enough to figure out where the communications are going, SNI helps quite a bit, but it may not be enough e.g. if a bad guy decided to use Twitter or AppEngine&#x2F;Spot or an S3 bucket for C&amp;C.<p>In a corporate environment your options are usually either network or host agent based, and frankly the network approach is significantly less intrusive, but also less effective.