If only companies had the processes to put these technologies in place. In my years of auditing organizations, I've found this to be a common situation. IT departments invest hundreds of thousands or millions in technologies like ISE or ACI that fully leverage good security practices, but they failed to implement.

Yes, the technology is there and the LEDs of the costly devices blink but the actual policies never get implemented. Just in my last visit I found a nice Tetration/ICE implementation that is on, but there are no enforcement of policies and the company continues in monitoring mode with no actual plans to enforce those policies. What a waste.