Ultimately it takes leaderships buy in. Even things like UAC or sudo/security profiles arent full proof. A lot of people will just type in their password or cli

Ultimately it takes leaderships buy in. Even things like UAC or sudo/security profiles arent full proof. A lot of people will just type in their password or click yes if prompted and they are perceptively trying to "do something". Even those that "work in tech" but not really security. I have had some good developers try and disable our security services, use proxies etc. And realistically my teams work hard to nurture relationships with dev and give them any and all tools they need. I tried, hard, to implement some basic account separation for people with admin access to backend infra. The goal was simply to reduce the possibility of EOP or lateral movement and really only more specifically only for those that work in Backend infra (aka Dev, Ops, SQL admins etc). Things like removing local admin with a normal account and using admin accounts for backend infra, escalation so the normal users email/browsers cant possibly dump lsass etc.. I got a LOT of pushback, to the point of being called names. I was told i cannot push further without possible recourse and cannot escalate the proposal to c-suites. My org wasnt even open to step 1...