Chuvakin believes logging is the most overrated coverage item: enterprises often say they have logs, but during incident response key DHCP logs, outbound traffic logs, or east-west traffic logs are often missing; he offers the "3 a.m. test" answer: one year of log retention is a good rule of thumb.