[Psitticine]

You have to be cranking out enough IPs so that your progress in a Counter-Intel (and/or Intel Sabotage projects) is fast enough to be comparable with the enemy's expenditure in its offense projects.

IOW, if you aren't spending enough on Counter-Intel, they'll get through. You need to have a CI project running to have the protection. They work as they are being "built", so to speak, but they stop immediately when the project is finished.