Security and compliance teams have real reasons to care about risky behavior from valid accounts. Most employees also have real reasons not to want their screens recorded. Vedric is built to detect risky behavior and explicitly does not do surveillance.
Currently supports Windows endpoints.
Most "employee monitoring" tools rely on screen recording, keystroke capture, webcam check-ins, and screenshot timelines stored in a vendor cloud. They collect content nobody wants to be responsible for, and they create liability rather than reduce it. They also rarely answer the actual question: is this account's behavior drifting outside its normal pattern?
Recording screens and keystrokes captures sensitive information you did not ask for and now have to protect. Once that data exists, every breach scenario is worse.
Visible surveillance changes how the organization works. Productive employees see it as a sign of distrust, and risky behavior moves to channels you do not see.
Many jurisdictions restrict monitoring. Examples include EU works councils, Quebec privacy law, and several U.S. states with biometric-data statutes. Content-level employee monitoring carries real legal exposure.
Even where surveillance is permitted, video and keystrokes do not show whether this account is behaving like itself. That is a per-user behavioral question, not a content question.
Vedric mainly reads endpoint behavioral metadata from process, command, authentication, network, file, and DNS sources. It has no screen, keystroke, microphone, or webcam collectors. When PowerShell Script Block Logging is available, an event can include a best-effort, credential-scrubbed preview of up to 2,048 bytes of script text plus a fixed truncation marker. Vedric discloses this content exception instead of hiding it behind a metadata-only label.
The collector records process and command metadata, observed activity windows, security-event cadence, DNS evidence, and host-level network aggregates. It does not claim a per-user destination ledger, and it does not read screens, keystrokes, or file bodies. The bounded PowerShell script preview is the documented content exception.
Detection compares the user against their own pattern, not a generic threshold. A junior analyst who occasionally works late is not flagged for that alone. It becomes part of a storyline only when it correlates with other off-baseline behavior.
Tenant admins can read the full storyline and audit trail for any primary identity in their tenant. There is no hidden surveillance layer reserved for employees considered especially sensitive.
There is no malware and no policy breach under traditional rules. A finance team member gradually starts doing their job differently, and that change is the signal.
The behavioral pattern was the signal. The collection inventory, including the bounded PowerShell script-preview exception, is stated explicitly so the customer can assess, disclose, and configure it with its works council, regulator, or workforce.
Employee risk monitoring usually means surveillance. Vedric does behavioral detection at the endpoint instead, and the surveillance collectors are left out of the agent's source code.
Read the full privacy stanceEarly access is for teams that need answers about behavioral risk without taking on the liability of surveillance data.