Technical controls matter, but policies and procedures decide whether those controls are applied consistently. In real environments, most security failures don’t start with a “mystery exploit”—they start with weak process: users who never signed an acceptable use policy, accounts that weren’t disabled on exit, devices that weren’t patched, and logs that weren’t retained long enough to reconstruct what happened.