You can have strong security tools but still get burned without solid...

https://garrettwigp625.tearosediner.net/how-to-calculate-186-000-arr-retained-from-retention-improvements

You can have strong security tools but still get burned without solid governance. Imagine managing 120 privileged accounts with no clear controls or a 7-day max temporary access rule that no one enforces