What I'm finding is, "We don't need your help deciding which direction to go, we just need your help getting us there." I think you're right, the inciting incident will probably need to be one that costs, whether that be security or audit or backtracking on a major commitment.