About Vedric
For twenty years, security budgets went mostly to the perimeter and to endpoint signatures. User behavior was left to other tools. Vedric is built for user behavior, which is where insider threats show up and which no existing tool fully covered.
Why Vedric exists
For the last twenty years, enterprise security has focused on the perimeter: block outside access, monitor entry points, and scan every incoming binary. This works against the threats it was designed for: external attackers, known-bad signatures, and credentials stolen from outside.
Insider risk does not fit that model. An insider has valid credentials, valid access, and a valid reason to be on your systems, until they no longer do.
Existing tools do not cover this well. SIEM aggregates insider logs into noise. EDR watches processes but does not know what is normal for each user. UEBA scores authentication events but does not see what users do after they log in. User behavior happens on the endpoint, and that is where these tools stop looking.
This gap was tolerated for a long time. In the last few years it has become unacceptable. Data egress incidents are no longer only external. Auditors in regulated industries now ask how their organization would detect an insider preparing to leave with material. For most programs, the honest answer is that they would not. Vedric is built to give them a real answer.
We do not collect content. Insider-risk detection does not need it, and the industry has a poor track record with collecting everything and sorting it out later.
We treat the forensic audit as a requirement. We sign every message, audit every write, and enforce tenant isolation at the query layer. An insider-risk platform should have these constraints from the start.
Vedric, 2026
Founder
I designed and built Vedric end to end: the Windows agent, the detection engine, the backend, the triage layer, and the console you run it from.
Every limit in the platform was set at the start, before there was any commercial pressure to loosen it: metadata over content, no keystrokes, no screenshots, no message bodies. These limits are not a policy that a later business decision can quietly change. They are written into the agent. The agent has no code path that reads a file's contents or activates a camera. That code is absent, not disabled.
Vedric is early and growing. Anyone who joins builds to the same standard. It is much easier to keep a limit set before the first customer than to put one back afterwards, which is why most platforms in this category never do.
You also deal directly with the people who build the product. If you raise an edge case, it goes to an engineer who knows the code path you are asking about, and a fix ships when it is ready.
Buying security software means trusting someone's judgment about what to collect and what to leave alone. Here you can see exactly whose judgment set those limits.
Send questions to me directly: ahmad@vedric.io
How Vedric is different
Behavior-based detection
Insider activity is almost always new, so a signature catalog cannot describe it. Vedric looks at how a user's activity today differs from what they have done for months, from what their peers do, and from anything the system has seen them do before.
Privacy by design
Vedric minimizes content at the source: no screens, keystrokes, file payloads, or message bodies. A bounded, redacted PowerShell script preview is the documented exception. Host-policy management is explicit opt-in.
Audit, storyline, and AI triage
AI triage is one component. The core of the product is the forensic audit and the correlated storyline. Remote response is a preview and is off by default. Detection works when the AI model is offline.
Comparison with other tool classes
SIEM
Aggregates events across the environment. Good at queryable history and compliance. No behavioral memory. Correlation is left to the analyst.
EDR
Watches processes on the endpoint. Catches known-bad patterns. Has no per-user baseline, no peer context, no multi-day storyline memory.
UEBA
Scores user behavior from log aggregation. Reads the identity and auth layer well. Does not see the host layer, where user behavior actually shows up.
DLP
Watches content flow at predefined egress points. Catches policy violations on specific document types. Misses insider behavior that does not touch a content policy.
What Vedric collects and does not collect
Data the agent collects
Set at agent install and re-verified on each collector pass
Collected
- Process and parent-process metadata
- Command-line activity
- Authentication events
- Network destinations (IPs, domains)
- File activity metadata (counts, types)
- Endpoint health and heartbeat
Not collected
- File contents
- Keystrokes
- Screen contents / screenshots
- Email and chat message bodies
- Document bodies
- Browser content / page source
Enforced in code, not by policy.
Enforced on the agent. Cannot be extended remotely.
The same team also does security engineering work. See services and federal.
Partnerships and hiring
We work with design partners on specific insider-risk programs. We take calls from analyst firms and compliance leads. We hire security, backend, frontend and Go engineers.