Just built a demo “monitoring matrix” for a slide in my blind spots talk. Many orgs I’ve worked with have the same idea: “we monitor our systems, visibility is pretty good, only a few systems are not integrated yet.” Then you put it into a simple table and the pattern is always the same: the top-left looks great. Servers and workstations send OS logs, basic auditing is enabled, some alerting exists. It feels like control. But when you go deeper, it gets thin fast. Application logs are missing, not collected centrally, not normalized - and often there isn’t even alerting defined for them. People also rarely agree on what a “critical” application-level alert should be. That needs application owners and security to sit down and define signals. OS-level monitoring is already hard; application-level monitoring is where many programs stop. And when you expand the coverage, it gets harder too. The further you move away from the “standard” systems, the more limits you hit: legacy systems, appliances, OT/embedded, unusual platforms, proprietary log formats, limited access, sometimes legal or organizational limits. Even if you get logs, they are often not easy to ingest and use. Main point: “we have monitoring” is not a checkbox. It’s a spectrum - and many environments are fairly wide, but shallow.