Most edr has a “this program is doing something bad” detector. But the number of folks running security on their build process is still not ubiquitous.