Security rulebases hold thousands of policies of unknown value. Which rules actually fire, which never match, and which shadow each other — nobody can say without a painful manual review.
"Our rulebase has grown for ten years and been cleaned never — how many of those five thousand rules do anything at all?"
Rulebase size
Policy review effort
To first utilization report