Recommendations vs Alerts
Recommendations prevent; alerts trigger investigation. Recommendation equals posture improvement (reduce risk). Alert equals threat notification (possible active attack). Different actions: remediate vs investigate/respond. Common mistake: treating them as the same thing.