Monitoring only failed attempts catches attackers who lack credentials but misses insider threats and compromised accounts that successfully access sensitive data. Successful access to sensitive data—especially unusual patterns—is often more significant than failed attempts. Focusing only on failures provides incomplete security visibility.