When are "point$-$in$-$time detection technologies" considered useless?

after the attacker has compromised the internet$-$facing firewall appliance

when a malicious file is not caught, or is self$-$morphing after entering the environment

when the IPS appliance detects an anomaly

when forensics are performed on the malicious payload to ascertain its origin and attack behaviors