Effective security assumes that some attacks cannot be stopped at the perimeter. So I also look at whether unusual behaviour will be visible, whether an alert carries enough context, and whether after an incident its course can be reconstructed instead of guessed at from fragmentary logs.
Incident Response, Detection Engineering, SIEM, Security Monitoring, Log Analysis, Audit Logs, EDR, IDS/IPS, IOC, Threat Hunting, MITRE ATT&CK, Alerting, Forensics, Incident Analysis, Post-Incident Review