Security is hard. It is only when you have to fight never ending scenarios from multiple users that you understand how limited a product that helps you is.

Crowdstrike helped us a few times to contain serious issues, and made me difficult for people as well because it blocked their "suspicious" behaviour.

The bad guys only need to succeed once.