The tool gives you visibility. Someone still has to act on it.
SIEM tools are often bought to solve a visibility problem, and they do. What they do not solve is what happens after you can see: who looks at alerts, who decides what is urgent, and who has authority to act.
Who owns a critical alert out of hours, and what is the response time? "The security team" is not an answer a 2am incident can use.
What counts as an incident that goes beyond the security team, to leadership or to regulators under frameworks such as the NCA Essential Cybersecurity Controls? Deciding this under pressure produces worse decisions than deciding in advance.
How does the SIEM connect to the risk register? A tool producing technical alerts on its own tends to become a specialist silo, outside governance.
Who reviews false positives and tunes the rules, and how often? Detection rules lose relevance without upkeep.
The tool is necessary. It is rarely enough. Treat ownership, escalation and response time as part of the deployment, not an afterthought.