There's value here in detection of a breach that's already been monetized, but this isn't in the kill chain; it's long-after, so it appears reactive-only.

Why should a non-massive company implement this rather than boosting and refining centralized logging and monitoring which can, if done right, provide far more immediate (even real time) notification of a breach? Your Wells Fargos of the world might do it because they can spare the change, and in your position I'd target the whales for initial revenue, certainly, but why should any mid-sized SaaS firm do it?

Not asking cynically. I want you to sell me on it.