[rietta]

I can answer this. For the same reason I have run ClamAV on Linux development workstations. Because without it, we cannot attest that we have satisfied all requirements of the contract from the client's security organization.

Also if you are a small business and are required to have cybersecurity liability insurance, the underwriter will require such sensors to be in place or you will get no policy.

[usefulcat]

If said underwriters don't typically cover things like the current CrowdStrike problem, that seems like a pretty big case of misaligned incentives.