You can have strong security tools but still get burned without solid...

https://garrettsbestblogs.theglensecret.com/nearly-40-of-tokens-not-rotated-in-nine-months-what-do-i-do-first

You can have strong security tools but still get burned without solid governance. Imagine managing 120 privileged accounts with no clear controls or a 7-day max temporary access rule that no one enforces