Tyro's CISO: Being the "Einstein of cybersecurity" isn't enough if developers don't trust you

This blog post argues that developer trust is a finite resource that security teams must manage when rolling out controls: mismanaged changes (e.g., removing local admin rights) damage productivity and trust, which undermines nuanced defenses like a 7-day package-version cooldown to mitigate supply-chain attacks. It recommends frictionless, in-workflow tools — IDE vulnerability scanning and device protection that blocks malicious packages/extensions at install time — so security can scale without repeatedly burning trust.