Early detection of an incident, and rapid response to contain the incident and prevent data loss, are essential. You can easily spend huge amounts of money on detection and auditing controls that will help detect indicators of compromise on systems you know about. But when you have systems and applications that you don't know about, or can't 'see’, your ability to detect compromises within these is hamstrung.