Most security tools focus on the perimeter. Vedric focuses on what happens after a trusted user, contractor, or service account is already inside, and flags when they start behaving outside their own pattern.
Currently supports Windows endpoints.
Endpoint protection blocks known-bad activity. Identity providers verify the login. SIEMs aggregate logs after the fact. None of them watch what a valid user actually does once their session is open. Insider risk sits in that gap. It covers honest mistakes, drifting service accounts, and borrowed credentials equally.
Built around process and binary verdicts. A signed PowerShell session running a legitimate cmdlet at 2am does not look like malware, and EDR will not flag it. Insider behavior almost never triggers a binary verdict.
Aggregates events. Good for retroactive search. Without per-user behavioral history, it cannot tell you that this user has not run that query in six months, only that the query happened.
Relies on file content and pattern-matching rules. Misses the behavioral pattern of staging, compression, and gradual exfiltration when the files themselves do not match a rule.
Most UEBA modules score authentication logs. They see who logged in. They often lack endpoint process and command metadata, authentication-event cadence, DNS and network aggregates, and removable-media write evidence.
The collector sends process and command metadata, security-event counts, DNS and network aggregates, sensitive-extension inventory, and removable-media write metadata. The cloud correlates only the evidence those collectors actually produce.
Each user gets a personal baseline of what they do: when, where, how often, and against which systems. After warm-up, the model has enough history that drift becomes visible without creating noise on a normal day.
A single deviation carries little weight. Three correlated deviations for the same user, endpoint, and time window form a storyline. Vedric sends only correlated activity to the analyst, typically one alert per investigation.
When a storyline forms, an AI triage layer reads only that tenant's context and produces a verdict, evidence chain, and recommended next action. Every tool call is read-only. Every action against the endpoint requires admin approval.
Identifying details are removed. This is a composite of behavioral patterns Vedric detects in the period before a departure. It is one of many patterns the engine recognizes.
The employee resigns on day 14. Vedric had eleven days of correlated warning. The analyst has one storyline with an append-only audit trail to bring to HR, legal, and the offboarding decision.
Vedric is designed to minimize content collection. The agent code enforces the list of refused collectors and the documented, bounded PowerShell exception.
Read the full privacy stanceEarly access is available to security teams, IT leaders, and MSPs running production Windows fleets who want behavioral visibility without invasive monitoring. We review every request manually.