Static rules go out of date. Vedric continuously updates its baselines from what the user, the endpoint, and the peer group actually do, so detection stays accurate without rewriting rules every quarter.
Currently supports Windows endpoints.
Most security tools start with a useful threshold that degrades over time. Endpoints, roles, and working hours change. A threshold that was correct six months ago can generate noise on Tuesdays and miss real activity on weekends. Behavioral platforms work the other way: instead of relying on written rules, they learn the user's own pattern and flag drift from it.
Tuned once at deployment, audited rarely, and unable to adapt to changes in the environment. Rules are either tightened until they fire constantly or relaxed until they miss what they should catch.
Effective when an attacker reuses known infrastructure. Not effective when the actor is a logged-in user accessing their own systems with their own credentials.
Many UEBA modules are static thresholds behind a dashboard. They group authentication signals into scores that are too coarse to show endpoint-level drift.
Good for questions like "what did this user do last week." Not designed to flag that a user is currently drifting from their own pattern unless someone asks that question first.
Vedric runs three baseline layers in parallel: the user against their own history, the user against their peer group, and the endpoint against its own history. A signal that fires on all three becomes a storyline.
Where identity attribution is available, Vedric records process invocations, command-line patterns, authentication-event cadence, DNS history, and bounded aggregate features. Filesystem inventory and removable-media evidence are labeled separately and are never presented as file reads.
Users are grouped into peer groups by department, role, and historical behavior. A query that is normal for one peer group and unusual for another is flagged only when it is unusual for this user's peer group. The decision does not depend on whether someone in IT runs the same query daily.
Each workstation builds its own behavioral history, independent of the user. Changes in process patterns, new-destination counts, DNS behavior, or event frequency can be flagged even when no user identity is available.
A legitimate background task was created years ago. It is owned by an account that is still valid and runs on a routine schedule. It starts connecting to a destination that was never part of its job.
There was no malicious user, no malware, and no EDR signal. Vedric detected it because it baselines the endpoint itself, not only the user who is logged in.
Vedric is designed to minimize content collection. The agent code enforces the list of refused collectors and the documented, bounded PowerShell exception.
Read the full privacy stanceEarly access is available to security teams that want a behavioral detection layer under their existing stack.