Devs in small companies often have a ton of access to systems and almost certainly aren’t heavily scrutinized about random novel binaries (being devs), so those are some of the first machines you’d target in an org.
You wouldn’t keylog “random devs”, you’d keylog all of the ones doing ops.
