Delayed IR access and 14-day logs limit visibility during breaches, increasing attacker dwell time and recovery costs.