“You have to implement the controls, but then monitor Um, how is it working? Like how many denials did you have? How many, um, permission grants did you have? And then what is the baseline? What are the deviations? who are the outliers?”

Transcript evidence from José Carlos Chávez - When Museums Get Hacked: OWASP Top 10 Lessons from Heists.