Answer
Shared privileged accounts are usually the oldest problem in the environment. A profile like QSECOFR or a homegrown "admin" user profile gets used by three or four people over the years because it is faster than provisioning individual *SECADM or *ALLOBJ authority, and by the time anyone tries to trace an action back to a person, the trail is gone. The fix is not just disabling the shared profile; it is building a provisioning process that grants individual special authorities matched to actual job duties, then reviewing that list on a schedule instead of only when an auditor asks.
Exit points are the second recurring gap. IBM i ships with exit points for FTP, ODBC, remote command, and other network access methods, but unless a security product or custom program registers against them, activity through those paths goes largely unmonitored even though QAUDJRN may be capturing object-level events. Buyers should ask how a candidate platform covers exit point registration out of the box versus how much custom exit program work is required. On alerting, the practical question is whether the software surfaces a small number of meaningful events, such as a profile gaining *ALLOBJ authority or a new user in a QSECOFR-class group, rather than flooding the security team with noise that gets filtered out and ignored within a month.