WeAreDevelopers Logo WeAreDevelopers
Sign in
For You LIVE
World Congress 2026 Europe • Jul 10, 2026 • Session details

The Developer Workstation Blind Spot: Why Your Security Stack Can't See What Matters Most

Marcus Wermuth

A single typo-squatted package can exfiltrate terabytes of data from a developer's machine unnoticed. Discover why traditional security tools are blind to this front door to production.

Pause
Mute Enter Fullscreen
#1 about 3 min

The hidden dangers of routine package installations

How a simple dependency installation can silently compromise credentials without triggering production alarms.

#2 about 3 min

Why security monitoring misses developer laptops

While production endpoints and cloud infrastructure are heavily monitored, the local developer machine remains dangerously unobserved.

#3 about 2 min

New local attack vectors introduced by AI agents

AI coding tools, MCP servers, and extensions operate with high privileges and alter local environments faster than human review.

#4 about 2 min

Evolving attacks from npm scripts to prompt injection

Attackers are shifting from visible post-install scripts to subtle natural language instructions in AI readmes.

#5 about 4 min

Real incidents of compromised local packages and tools

Recent vulnerabilities in heavily downloaded packages and AI utilities highlight the severe risk of local data exfiltration.

#6 about 3 min

Why existing security and device management tools fail

Standard EDR, SCA, and MDM platforms lack situational awareness for complex local assets like MCP configurations and hidden dot files.

#7 about 3 min

Practical ways to audit local environments manually

Development teams can mitigate risks by running simple inventory commands and enforcing package version cooldown periods.

#8 about 4 min

Discovering unexpected assets through local system scans

Directly scanning a development workstation reveals forgotten dependencies, outdated extensions, and stored plain-text tokens.

#9 about 2 min

Gaining visibility without blocking developer workflows

Generating an upfront asset inventory gives security teams critical oversight without immediately blocking necessary engineering tools.

#10 about 3 min

Securing non-developer workstations and driving organizational adoption

Using concrete incident data helps convince leadership to secure not just engineering machines, but all laptops utilizing AI.

Matching moments

5:44 min

Risks of malicious VS Code extensions and AI assistants

Chris Heilmann Chris Heilmann +3 · LIVE

2:01 min

The necessity of developer intelligence amidst automated attack generation

Julian Totzek-Hallhuber Julian Totzek-Hallhuber · World Congress 2024

2:30 min

Bridging the gap between developers and security tools

Bozidar Spirovski Bozidar Spirovski +1 · Coffee With Developers

4:15 min

Security integration and AI skepticism in developer tooling

Chris Heilmann Chris Heilmann +2 · LIVE

2:17 min

Security incidents in extension marketplaces and package managers

Chris Heilmann Chris Heilmann +2 · LIVE

2:40 min

Identifying command injection flaws in developer infrastructures

Vandana Verma Sehgal · LIVE

More from World Congress 2026 Europe

Building the Nervous System of AI - Michael Kagan (NVIDIA) thumbnail
29:17
3 months ago

Building the Nervous System of AI - Michael Kagan (NVIDIA)

Michael Kagan, Sead Ahmetović

Five Things in Tech that Matter Now - WeAreDevelopers World Congress 2026 Closing Keynote thumbnail
19:41
3 months ago

Five Things in Tech that Matter Now - WeAreDevelopers World Congress 2026 Closing Keynote

Christian Heilmann

The Sound of Your Secrets: Teaching Your Model to Spy, So You Can Learn to Defend thumbnail
32:06
3 months ago

The Sound of Your Secrets: Teaching Your Model to Spy, So You Can Learn to Defend

David vonThenen

Super scaling for the Super Bowl: How to survive 30 million users hitting your backend in 30 minutes thumbnail
35:13
3 months ago

Super scaling for the Super Bowl: How to survive 30 million users hitting your backend in 30 minutes

Irina Branovic

Running Secure Life Science Research at Scale using Hybrid GPU HPC and Kubernetes 🧬 thumbnail
24:23
3 months ago

Running Secure Life Science Research at Scale using Hybrid GPU HPC and Kubernetes 🧬

Jeremy Murray

Angstfreude - AI and Corporate Culture - The Thrill and the Threat thumbnail
30:26
3 months ago

Angstfreude - AI and Corporate Culture - The Thrill and the Threat

Axel Ebert, Karin Krobath

Related videos

Checkmate: 5 Real Incidents That Can End a Software Company thumbnail
27:08
World Congress 2026 Europe • 3 months ago

Checkmate: 5 Real Incidents That Can End a Software Company

Jasmin Azemović

Stranger Danger: Your Java Attack Surface Just Got Bigger thumbnail
1:58:59
LIVE • over 4 years ago

Stranger Danger: Your Java Attack Surface Just Got Bigger

Vandana Verma Sehgal

The AI Security Survival Guide: Practical Advice for Stressed-Out Developers thumbnail
30:36
World Congress 2024 • about 2 years ago

The AI Security Survival Guide: Practical Advice for Stressed-Out Developers

Mackenzie

How to Defend Against Data Manipulation Attacks - Bozidar Spirovski & Wekoslav Stefanovski thumbnail
38:44
Coffee With Developers • 7 months ago

How to Defend Against Data Manipulation Attacks - Bozidar Spirovski & Wekoslav Stefanovski

Bozidar Spirovski, Wekoslav Stefanovski

The New AI Security Stack: Observe, Detect, Protect thumbnail
30:16
World Congress 2026 Europe • 3 months ago

The New AI Security Stack: Observe, Detect, Protect

Milin Desai, Christian Trummer, Jyoti Bansal, Tomislav Tipurić

Simple Steps to Kill DevSec without Giving Up on Security thumbnail
21:53
World Congress 2025 • about 1 year ago

Simple Steps to Kill DevSec without Giving Up on Security

Isaac Evans

Related articles

From learning to earning

Jobs that call for the skills explored in this talk.