Efforts to tune or build behavior- or signature-based threat identification requires time and effort most organizations don't have.