When malicious insiders are aware that traditional tools can’t detect individual behaviors and intimately know your IT environment and where your critical data resides.
When increased layers of authentication make your organization more secure, but make users’ lives more difficult.
When determining the extent of the damage caused by an attack or human error becomes too resource intensive.