Where the pressure started.
The client had no central place where security logs came together. Suspicious activities were only noticed after the fact, usually when something broke. Firewalls, servers, cloud workloads, Active Directory and security devices each had their own console, and the internal team could not correlate signals across them. Compliance reporting was a manual scramble every quarter.