What MDM can't protect on developer machines (and what to do about it)

MDM solutions (Jamf, Kandji, Intune) and EDR provide valuable OS-level and runtime protections but are blind to developer-specific attack surfaces such as package manager installs (npm/pip), IDE and browser extensions, and AI/MCP tooling; the report documents real incidents (an abused VS Code extension that exposed thousands of GitHub repos, the Mini Shai-Hulud npm worm stealing tokens from developer machines, and extension-update based breaches) and recommends layered mitigations—enforce package age policies, block postinstall hooks by default, audit and centrally control extensions, monitor AI tool installs, and deploy dedicated developer endpoint protection that integrates with MDM.