Cutting down your privileged accounts from 120 to just 30 can slash your mean...

https://uniform-wiki.win/index.php/How_to_Instrument_Monitoring_for_Production_Access_Outside_Approved_List

Cutting down your privileged accounts from 120 to just 30 can slash your mean time to detect from 35 days to under 3. I did this with Okta’s governance features—and avoided a $145,000 compliance penalty in the process