5. Manage and Monitor Security Posture (20-25%)

Every control covered in Phases 2 through 4 is only as good as your ability to know whether it's actually working, everywhere, all the time. This phase is the outermost layer from Phase 1's defense-in-depth model — Defender for Cloud answers "how well-postured is my environment right now," Sentinel answers "what's actually happening, correlated across everything," and Security Copilot accelerates how fast you can turn either answer into action.