Critical to make them secure, but not essential to make them work.
There ought to be a law.
Organizations with a competent “brain trust” are rare. And where they exist, you see multiple specialized platforms for configuration control. And multiple other platforms for monitoring, alerting and ticketing.
Or course, scale matters.
And that’s why we’re in business...well, except for me. I’m recently retired.
It all comes down to competent IT Management, which is more rare than a competent engineering staff. And quickly becoming extinct.
I’ve got 20 years or so left. I’m constantly talking to anyone who’ll listen about how security “professionals” are more focused on products than practices. We need a groundswell of support that just isn’t there. Security is tough, unforgiving work. You have to be right more than the bad guys and they’re changing strategies daily.