For me, I want the service to be able to protect my organization against the widest array of threats, be able to effectively deal with new threats, and give me as much information/visibility as possible (in an efficient manner) to handle the exceptions.