@Pavel Hrabec Thank you for such a detailed answer, Pavel, this is really valuable to hear from the inside! 🙏🏾 That split makes a lot of sense: GRC sets the rules for what data agents can touch, and the SOC enforces them and gets alerted when someone breaks them. It reminds me of my asset work. You can't govern what you can't inventory, and it sounds like AI usage is hitting that same wall right now. Companies first have to find out which AI tools people are actually using, and with what data, before they can control any of it. Curious: for the visibility piece, are you relying mostly on licensed tools (DLP, browser or endpoint monitoring), or does a lot of it still start with policy and user attestation?