> It's questionable how much such tools actually improves security, most of it appears to be a power grab by someone in charge of security, usually there's no transparency, and even C*Os aren't aware of how much they are snooped on. For example (as atp does), recording of all commands including arguments, stored in a searchable database.

I would agree it's often a power play for would be corporate cyber-warriors.

But the tools are very effective for certain threat categories. The downside is that they require skilled operational security people to be used effectively, and may security organizations are mostly compliance focused and don't have the talent or framework to pivot the organization. It's similar to how underperforming IT organizations were/are aligned with the CFO -- many security orgs are aligned with counsel/risk.