oh absolutely, there's a bad problem in security where people don't want to admit there might be a chance their controls aren't perfect, and by deploying better

oh absolutely, there's a bad problem in security where people don't want to admit there might be a chance their controls aren't perfect, and by deploying better detect/react controls you are very much admitting that point. So there's a tendency to downplay those requirements (what OS or application vendor is going to say "hey you should deploy something for when our security fails on you")