Stop guessing what developers install
Billy McGee
See your fleet's actual package inventory for free in less than 5 minutes.
If you're asked right now what's actually installed on every developer laptop in your fleet… could you answer it? Most security and IT leaders can't.
This started as a Mac problem. It isn't anymore.
Homebrew is the quiet backbone of developer productivity. It It's what engineers install on day one (without asking permission) because it's just how everyone gets developer tools on a Mac. That made it a macOS-only story for years. Not anymore.
Homebrew now runs natively on Linux and inside WSL, which means the exact same blind spot that's been sitting on your Mac fleet is quietly showing up on your Linux workstations and your Windows developer machines too. And the open source Homebrew package manager model is part of a broader pattern. The same self-serve, developer-installed model shows up in npm packages pulled straight into a project, in VS Code extensions installed with a single click, in any tool that lets a developer go from "I need this" to "I have this" without IT and Security ever seeing it or approving it. To complicate matters further, these installation routes can often be nested, for example a VS Code extension that installs dependencies from npm that install dependencies from pip, and on and on.
How can you get a grip of how many self-installed software layers are running across your fleet right now? Administrators and security teams have relied on a mix of methods that aren’t always portable across operating systems, or resilient to environment changes. Let’s explore the common tools, and how Workbrew offers another way.
| Detection method | How security tools detect it | Limitations (what’s still in the shadows) | How Workbrew works | What Workbrew provides |
| 1. Process execution monitoring | EDR logs processes executed from /opt/homebrew/bin or /usr/local/bin. | Only sees executed binaries, not installed ones. Packages sitting unused remain invisible (but potentially vulnerable). Also cannot reliably attribute installs to brew vs manual binaries. | Workbrew runs a policy-aware CLI wrapper around brew commands. | Full visibility into install actions and package state, even if the binary is never executed. |
| 2. Application discovery scans | Periodic scans check for /opt/homebrew, /usr/local/Cellar, or brew binary presence. | Detects brew installation but not accurate package inventory. Scans are periodic so installs between scans may be missed. | Workbrew continuously reports installed packages and versions. | Real-time software inventory across the fleet. |
| 3. Network monitoring | Security tools observe downloads from GitHub, brew bottle registries, etc. | Traffic is ambiguous (GitHub used for many things). Cached bottles or internal mirrors bypass detection. Offline installs are invisible. | Workbrew records installs through the managed brew execution path. | Definitive install telemetry without relying on network inference. |
| 4. Privilege escalation detection | PAM tools detect sudo or admin privilege requests during install. | Many brew installs don’t require sudo, so they bypass this signal entirely. | Workbrew enforces install policies and privilege modes. | Visibility into all installs, not just privileged ones. |
| 5. File integrity monitoring | File monitoring detects new directories or executables in brew paths. | Detects file changes but does not know which package created them. Can generate noise from normal developer workflows. | Workbrew knows exactly which package and version created the files. | Package-level attribution instead of raw file events. |
| 6. PATH inspection | Security tools inspect environment variables for /opt/homebrew/bin. | Only indicates brew might exist. Cannot determine what packages are installed or used. | Workbrew manages the brew environment and package list. | Direct knowledge of installed tools, not just environment hints. |
| 7. Behavioral detection | EDR infers developer tools by observing behavior (compilers, node, python). | Highly indirect. Behavior could come from manually installed tools or other package managers. | Workbrew tracks actual package installations and upgrades. | Eliminates behavioral guesswork with authoritative package data. |
| 8. Brew command logging | Security logs record commands like brew install kubectl. | Logging depends on shell/process monitoring and may miss installs if logs aren’t collected or retained. Also doesn’t track resulting package state reliably. | Workbrew validates and records brew commands via its managed CLI. | Reliable audit trail + resulting package inventory. |