Logging

Logs only help if they are collected, kept long enough, reachable when you need them and actually looked at.

Each of those fails independently and quietly. A system logging perfectly to a disk nobody ships anywhere is useless during an investigation. So is a log retained for thirty days when the intrusion started four months ago. The question is never whether logging is enabled. It is whether you could reconstruct last March, and most organisations do not find out the answer until they need it.