I work in IT security. We monitor and keep logs for all the traffic in our enterprise, several months worth of data on hand, so if an incident does come to our attention, we have the materials on hand to properly identify the problems and we can play attention to the systems affected.

We don’t have the time, resources, or inclination to actively monitor every single keystroke entered by every asset we manage. Its not feasible, nor is it even necessary.