Most incidents start with access, not with malware.
Accounts that outlived the person, permissions granted for one task and never withdrawn, shared credentials for a system nobody owns, and administrative rights handed out because it was quicker. None of that needs a sophisticated attacker. It needs somebody to notice, and noticing is a process rather than a purchase.
A tool nobody watches is a false sense of security.
Monitoring that produces alerts into an unattended inbox is worse than none, because it turns an unknown risk into a documented one that was ignored. The question is not what the tool detects. It is who receives the alert, what they are authorised to do about it, and what happens at two in the morning.
We start with identity and the response path.
Establish who has access to what and why, remove what is no longer justified, and put joiners, movers and leavers on a process rather than on memory. Define what must be logged and who reviews it. Agree the response path, including the decisions somebody may take without waking an executive. Then choose tooling to support that, in that order.
What you are left with.
An access position you can evidence, a leaver process that actually removes access, logging aimed at the questions you will need to answer, and a response plan that has been walked through rather than written and filed.