We use a combination of https://www.templarbit.com and Splunk. Templarbit allows us to get real-time notifications when someone is running a vuln scan, violates one of our security headers or is trying payloads that look funny.
"I think that the role of the warm referral is misinterpreted." absolutely agree with him here, but wish he would elaborate on how to "get in the network", which basically means you show up and you show up bringing value