Fundamental monitoring and good architecture are the keys to preventing any type of exploit, zero-day or other. Zero Trust architecture was proposed to segment/microsegment information assets and prevent the spread of various attacks, and that is a very strong start.
Traffic, status code, pattern monitoring, and anomaly detection are also key. So many attacks these days are based on things like credential stuffing and I always ask myself, why didn't all the failures trigger an alert? Why am I suddenly transferring TB of data in the middle of the night? Malicious actors can hide a lot of ways, but in most cases, they want data in the end, and the fact that data is moving is difficult if not impossible to hide. AI/ML systems that can monitor big parts of your network are great if you can afford and maintain them commensurate with your risk. If you have a smaller company, perhaps a dashboard, SIEM or not, checked daily that has status return codes, logins, etc. for a human operator to note large changes in the behaviors.
Basic blocking and tackling wins games and saves companies. It drives me crazy to see all the investment that goes into highly complex tools when organizations haven't done the fundamentals well. It might be a very shiny thing to show off, but is it delivering the real value?
