How default policies, unmonitored accounts, and unchecked alerts leave many organisations exposed without knowing it.