You can have strong security tools but still get burned without solid...

https://milosinterestingcolumns.huicopper.com/how-to-handle-customers-invoking-audit-clauses-after-a-security-scare

You can have strong security tools but still get burned without solid governance. Imagine managing 120 privileged accounts with no clear controls or a 7-day max temporary access rule that no one enforces