The interesting effect of moving to a graph-based cloud security tool was organisational rather than technical. Before, security produced a list of misconfigurations and engineering ignored it because everything was labelled critical. Now we show a specific path from an internet-facing workload to a privileged role and the argument ends in a minute.
The risk I am watching for is the opposite failure: engineers ignoring anything without a dramatic path, when plenty of real problems are boring.
We have seen exactly that. Findings without a visualised path get triaged as low regardless of what they are. We now sample them in review so at least the boring ones get a look.
The other thing worth saying: the graph is only as good as the permissions data underneath it. Ours had gaps in one account for six weeks and nobody noticed because the picture still looked plausible.
The permissions gap point is important. We added a check that the connector coverage itself is monitored, because a silently incomplete graph is worse than no graph, it is a confident wrong answer.