Both can be bypassed by smart attackers who know they’re being profiled.
Both have moderate success in catching less-dedicated attackers.
You shouldn’t think either is a defense by itself.
Despite their weaknesses, they are still an essential part of a security program.
In other words, both security layers are worthwhile, but they both also become dangerous when their effectiveness is overestimated. ::