All the time I've worked in security I've seen that detection beats prevention because of this reality, nice to see some studies on it.

(This is why we built https://crowdalert.com, amusingly)