Security problems don't always start with a major incident. More often than not, it's the tiny gaps in monitoring that turn into much bigger risks over time.