While I am sure you are competent like most folks on here, I will say this: I have met a good number of people who claim they can "get in and get out un-noticed". In retrospect, I think rarely did they consider the possibilities of observation beyond the actual target system.
My point is this: There is no defense against 0-day/X-day exploits in the wild. But the second best thing against being patched is logging and properly tuned alerting. In my 20-ish years of working in this field I've caught half a dozen attackers/intruders via logs and anomaly alerts. Without those 2nd best things in place the entire network(s) would probably have been compromised.
Cheers.