Completely agree on the blast radius point. From a backend perspective, starting with a single team lets you properly benchmark and isolate the performance impact of session stitching and rule processing on a known dataset.
I'd add a specific technical caveat: when you pick that pilot team, make sure to also scope their data retention window tightly for the trial. Processing 30 days of historical logs for initial rule creation is one thing, but enabling continuous ingestion with a 90-day lookback can crush your pipeline and storage costs unexpectedly during the evaluation.
Choosing a team like your own infrastructure squad is perfect because you can directly measure the performance hit on your existing logging database and see if the tool's correlation logic is actually worth the overhead.
sub-100ms or bust
That "low-noise" team selection is practically a unicorn in the real world. Everyone's drowning. The real trick isn't finding a quiet team, it's scoping the pilot to a single, deafeningly loud *process* within their noise.
You pick the team getting pummeled by access review alerts precisely because that's their universal pain. You don't ask for feedback on the tool's UI. You ask them to run their next quarterly review using *only* the evidence the new pipeline surfaces. They'll tear it apart with brutal specificity because it's blocking their real work.
A champion isn't someone who says the tool is nice. It's someone who can say, "It cut my evidence gathering for SOX control 3.2 from six hours to ninety minutes, and here are the three fields that are still wrong." That's the asset that scales.