How does Vedric Detect pricing work?

Vedric Detect is priced per endpoint, per month. Contact our sales team for a custom quote based on your organization's size and requirements.

How long does it take to deploy Vedric Detect?

The Vedric Detect agent installs in under 5 minutes per endpoint. A GUI installer or silent enterprise deployment command handles everything. No infrastructure changes or reboots required.

What operating systems does Vedric Detect support?

Vedric Detect supports Windows 10, Windows 11, and Windows Server 2016+ endpoints today.

How is data stored and protected?

All data is encrypted at rest and in transit. Tenant data is fully isolated. Vedric enforces two-factor authentication and role-based access controls for all dashboard users.

What is insider threat detection?

Insider threat detection identifies security risks from people who already have authorized access to your systems, employees, contractors, and partners. Vedric Detect uses behavioral analytics to learn normal patterns and flag anomalies that could indicate data theft, credential compromise, or policy violations.

How does the platform handle role changes and team moves?

Peer baselines update as the user's clustering changes. Personal baselines weigh recent behavior more heavily so a deliberate role change does not generate persistent false positives. Both surfaces are visible to a tenant admin.

What happens during the first week on a new endpoint?

A per-device personal-baseline warm-up before alerts fire. The agent logs behavior to build that baseline while the platform leans on mature role/peer baselines (where the tenant has built the cohort up) to surface high-confidence alerts on new devices. On a fresh device with no peer cohort, alerts are suppressed as low-confidence. After warm-up, drift against the user's own pattern is added.

Is this a SIEM replacement?

No. SIEM is a search and aggregation layer; Vedric is a detection layer. Many teams forward Vedric's correlated storylines to their SIEM as enriched events. The two are complementary.

How is the AI triage layer prevented from being prompt-injected?

Multiple layers. All endpoint telemetry is treated as untrusted data, run through a regex injection sanitizer, and passed inside structural fences in the system prompt. The triage tools are read-only and tenant-scoped. The system prompt itself frames every input as adversary-influenced.

Vedric

Join the waitlist

BEHAVIORAL SECURITY PLATFORM

Every signal is stronger compared against normal.

Static rules age fast. A behavioral platform rebases continuously against what the user, the endpoint, and the peer group actually do - so the signal stays sharp without rewriting rules every quarter.

Request Early Access View PlatformWindows endpoints today.

THE PROBLEM

Static thresholds expire faster than they get reviewed.

Most security tools start with a useful threshold and degrade. Endpoints change. Roles change. Working hours change. The threshold that was correct six months ago is now generating noise on Tuesdays and missing the actual signal on weekends. Behavioral platforms invert the contract: instead of writing rules, they read the user's own pattern and surface drift against it.

WHY CURRENT APPROACHES FALL SHORT

Rule-based stacks are working harder for less signal.

STATIC RULES

Tuned once at deploy, audited rarely, and unable to learn from environmental change. Rules either tighten until they fire constantly or relax until they miss what they should catch.

INDICATOR LISTS

Powerful when the attacker reuses known infrastructure. Useless when the actor is a logged-in user touching their own systems with their own credentials.

THRESHOLD-DRIVEN UEBA

Many UEBA modules are static thresholds wrapped in dashboards. They cluster authentication signals into scores that are too coarse to see endpoint-level drift.

AGGREGATED LOG SEARCH

Excellent for "find me what this user did last week." Not designed to surface "this user is currently drifting against their own pattern" without someone framing the question first.

HOW VEDRIC HELPS

Three baselines, one verdict.

Vedric runs three baseline layers in parallel: the user against themselves, the user against their peer group, and the endpoint against its own historical shape. A signal that fires on all three is what becomes a storyline.

01 /PER-USER

The personal baseline

Process invocations, command-line shapes, file-access cadence, login windows, and network destinations are accumulated per primary identity. Drift is measured against the user's own statistical history, not against an arbitrary threshold.

02 /PER-PEER

The cohort baseline

Users are clustered into peer groups by department, role, and historical behavior. A query that is normal for one cohort but anomalous for another lights up only when it is anomalous for this user's cohort - not because someone in IT runs it daily.

03 /PER-ENDPOINT

The host baseline

A workstation builds its own behavioral history independent of the user. A service breaking character - new destinations, different access scope, elevated frequency - fires even if the human at the keyboard looks fine.

EXAMPLE SCENARIO · TIMELINE

A scheduled task that drifts off character.

A legitimate background task - built years ago, owned by an account that is still valid, running on a schedule no one questions - begins reaching out to a destination that was never part of its job.

T+01
T+01 - scheduled task fires on its normal cadence. Endpoint baseline is stable.
T+02
T+02 - same task starts a new outbound connection. First time seen. Logged on the per-endpoint baseline.
T+03
T+04 - connection repeats. Still benign-looking. Building toward a per-host deviation.
T+04
T+06 - endpoint baseline crosses confidence threshold for "service has changed character." Alert correlates the new destination with the historical task identity.
T+05
T+06 - Vedric promotes the correlated pattern as a storyline tied to the task, not the user. Analyst is given a recommended action: pause the task, inspect the upstream change.
T+06
T+07 - admin reviews. Turns out a recent maintenance script silently re-pointed the task at a staging URL. Everything else was correct.

OUTCOME

No human malice. No malware. No EDR signal. The detection landed because the platform baselines the endpoint as a thing in itself - not just whoever is logged in.

WHAT VEDRIC SURFACES

A platform that watches behavior across three axes.

VEDRIC SURFACES

Per-user, per-peer, and per-endpoint baselines running in parallel
Correlated storylines that promote multi-axis deviations as one alert
Tenant-scoped AI triage with read-only tools and an admin-gated response layer
Append-only audit trail across detection and analyst response
Configurable response actions ranging from "log only" to "isolate after admin sign-off"

VEDRIC DOES NOT DO

Read content from screens, files, messages, or audio
Score logins or auth events alone - every signal is correlated with endpoint behavior
Take actions on endpoints without an admin approval and a stated reason
Share data, models, or telemetry across tenants
Use a single static rule set as its primary detection logic