* why am I seeing ingress/egress traffic to an IP I thought was firewalled? * why am I seeing triggers to IDS signatures on hosts I thought didn't communicate in/out to the internet? * why am I seeing web traffic bypassing a content filter/proxy I thought everyone had to use? * why am I seeing router/switch VLAN/routing errors that could expose more of my network? * if I continue to buy all of those technologies, how do I monitor them to know that they are functioning/doing their job/reporting any exposure? * how do I know if I've been exploited/exposed?
If you use it right, it isn't just a post-attack/exposure response and investigation system, it can be an early warning system, and an aid in your normal incident response techniques. If you do get exposed (which unfortunately does happen to most organizations - whether it's a simple policy violation or a worm infection or worse), it can help with containment (who is still infected?), patient zero identification (when/where did it start?), and mitigation itself in some cases (though that's not always practical or possible).
For a lot of people/teams, knowing really is half the battle. A lot more are strapped for resources and using a tool to extend the IT team does enable better security in that it enables them to focus their time somewhere other than monitoring.