A company runs 300 accounts in AWS Organizations across four AWS Regions, and its platform team creates new accounts most weeks. A central security operations team, which works from a dedicated security tooling account, must see Amazon GuardDuty findings for every account in one console, must be able to change detector settings for member accounts itself, and must have coverage begin on any new account with nobody remembering to act.
Company policy is that day-to-day security operations must not be performed from the organization's management account, and the platform team does not want to maintain a per-account stack that a local administrator could delete.