Nobody argues about this one. You cannot detect what you cannot see, and you cannot investigate what you didn't log. Ask any security team whether they want telemetry on every host and the answer is yes, obviously, every time. The right answer has never been in dispute.
And yet I have never worked at a place with full coverage. Not one. Every environment I've been responsible for had a number on the dashboard that said something like 87% of hosts reporting, and that number sat there for years. Not because anyone was lazy. Because the last stretch is genuinely hard, and the way we've built things gives nobody a safe way to finish it.
Getting a log agent or EDR sensor onto a host means making a change on that host. One host, one small change, low risk. Fine. Now do it on every machine you own, including the ones you'd rather not touch.
That's where it stops being easy. Coverage isn't a detection problem or a tooling problem. It's a change-management problem wearing a detection problem's clothes. To get to full coverage you have to push a change across the entire fleet, and a fleet is not a uniform thing. It's a well-behaved majority and a long, ugly tail.
The first 85% goes fine because those hosts are the managed ones. They're in the config-management system, they're in the inventory, they look like each other, and pushing an agent to them is a routine job.
The tail is where it dies. The tail is the ten-year-old box running the thing finance depends on that no one will let you reboot. It's the appliance the vendor told you not to install anything on. It's the host that isn't in the inventory because someone stood it up in 2019 and never told anyone. It's the fragile one, the unmanaged one, the unknown one. Each of these is a small risk and a small effort on its own, and each one needs a human to stop, figure out what it is, decide whether the agent will break it, and own the outcome if it does.
There's no safe, reversible way to make that change and back it out cleanly if the box falls over. So the rational move — the same rational move I wrote about with unresolved findings — is to leave it alone. Multiply "leave it alone" across a few hundred hosts and you get a project that is permanently 85% done. It never gets to 100 because the last 15% is the part nobody has a safe path through.
Here's the cruel version. The hosts you couldn't cover are not a random 15%. They're the old, weird, poorly understood, off-inventory machines. That is the exact profile of the host an attacker wants, and the exact host an incident lands on.
So the blind spot in your telemetry is highly correlated with where the trouble actually is. When you're mid-incident, pulling logs, building a timeline, trying to answer "did they touch this," the gap in your visibility is not spread evenly across boring servers. It's sitting right on top of the machine you most need to see.
The thing that's missing isn't a better agent or a smarter dashboard. Those are fine. What's missing is a safe, reversible way to make a change across a whole fleet — including the fragile tail — where you can see exactly what will happen before it runs, and undo it cleanly if a host doesn't like it.
If pushing an agent to that scary 2019 box were a bounded change you could reverse in a hurry, the calculus flips. The reason the tail stays uncovered is that the downside of touching it is unbounded and the person touching it eats that downside personally. Take the unbounded downside off the table and the tail stops being a place people avoid. Then, and only then, does "get telemetry everywhere" stop being a slide and start being a thing you can actually finish.