One thing you could deploy throughout all your internal networks are honeypots that send alerts upon ANY network activity. Nobody should be hitting those at all.