Security: Where do we go from here?

This all depends on what and where you are being secured. Secureing for external attacks and hacks can be done with Hardware, Software, procedures, policies and DMZ design. A strong web services architecture will reduce your risk to a very small precentage but you will never reach zero risk.

If we are disucssing the Internal risk of intrusion and hacking, then you are getting into a balancing act, where security needs are sometimes diametrically opposite to the needs of business and productivity. Tossing hardware and software at internal security is less effective than training and background checks and having that information updated yearly. You still need the hardware, software and monitoring. But the biggest bang is training, procedures and policies.

I think that ISP's are going to have to shoulder a greater portion of security tasks, becuase they are the portal to the Internet. Their equipment can easily tell if traffic volume suddenly increases for a certain client, and quickly determine the nature of it. They also can detect unusual activity and monitor it, perhaps checking with the client to see if an install or update is in progress. The staff of an ISP is generally more knowledgeable about computer system then the clients are, and probably can spot problems before the client will, if they are looking for them.

Eventually IT security will have to model itself after physical security. Whether you state it as layers or boundaries and areas, the principles are the same.
1. Define areas of controlled access and allow entry with permission (boundary/access control).
2. Assume access control is NOT 100% EFFECTIVE and monitor activity inside controlled areas for suspicious behavior (area/intrusion detection).
This two part approach is fundamental to good security.