Two big ideasPosture reduces risk; protection detects threats. Posture equals fix risky settings before an attack. Protection equals detect suspicious runtime behavior. Recommendations map to posture work. Alerts map to investigation/response work.