> which failed to detect unauthorized access in many instances. Did something else detect them in a timely manner, or did you find evidence later as part of so

> which failed to detect unauthorized access in many instances. Did something else detect them in a timely manner, or did you find evidence later as part of some sort of audit? (or was the inadequacy found via staged penetration testing?)