Insider risk is the access you already granted.
Most security tools focus on the perimeter. Vedric focuses on what happens after a trusted user, contractor, or service account is already inside - and starts behaving outside their own pattern.
THE PROBLEM
Trusted access is the part of your stack that nobody is watching.
Endpoint protection blocks known-bad. Identity providers verify the login. SIEMs aggregate logs after the fact. None of them watch what a valid user actually does once their session is open. Insider risk lives in that gap - and it covers the honest mistake, the drifting service account, and the borrowed credential equally.
Insider risk is invisible to perimeter-shaped tools.
Built around process and binary verdicts. A signed PowerShell session running a perfectly legitimate cmdlet at 2am does not look like malware - and EDR will not flag it. Insider behavior almost never trips a binary verdict.
Aggregates events. Excellent for retroactive search. Without per-user behavioral memory it cannot tell you that this user has not run that query in six months - only that the query happened.
Tied to file content and pattern-matching rules. Misses the behavioral shape of staging, compression, and gradual exfiltration when files themselves do not match a rule.
Most UEBA modules score authentication logs. They see who logged in. They often lack endpoint process and command metadata, authentication-event cadence, DNS/network aggregates, and removable-media write evidence.
Vedric watches what valid users actually do - and notices when it changes.
The collector ships process and command metadata, security-event counts, DNS/network aggregates, sensitive-extension inventory, and removable-media write metadata. The cloud correlates only the evidence those collectors actually produce.
Per-user, per-peer behavior memory
Every user gets a personal baseline of what they do: when, where, how often, against which systems. After warm-up the model has enough memory that drift becomes visible without triggering noise on a normal Tuesday.
Storylines, not raw alerts
A single deviation is a footnote. Three correlated deviations across the same user, endpoint, and time window are a storyline. Vedric promotes only correlated activity to the analyst surface - typically one alert per investigation.
Tenant-isolated AI verdicts
When a storyline materializes, an AI triage layer reads only that tenant's context and produces a verdict, evidence chain, and recommended next action. Every tool call is read-only. Every action against the endpoint is admin-gated.
EXAMPLE SCENARIO · TIMELINE
A senior developer in their last two weeks.
Identifying details removed. This is a composite of behavioral shapes Vedric reads in the run-up to a departure - one of many patterns the engine recognizes.
- T+01Day 03 - query pattern outside the user's six-month norm. Logged as a deviation. Not yet alerting.
- T+02Day 05 - access scope drifts outside their assigned project. Same credentials, different behavior. Correlated against the day-03 deviation.
- T+03Day 08 - off-hours activity in a window the user has never worked in before. Temporal deviation logged.
- T+04Day 09 - three deviations on the same user/endpoint within six days. Storyline materializes. One alert reaches the analyst surface.
- T+05Day 11 - privileged query not seen in the last six months runs against a system outside the user's normal scope. Privilege-drift signal added to the storyline.
- T+06Day 13 - egress volume above personal baseline, during off-baseline hours. Exfiltration-shaped pattern flagged for response.
On day 14 the employee submits resignation. Vedric had eleven days of correlated warning. The analyst has a single storyline with an append-only audit trail to bring to HR, legal, and the offboarding decision.
Designed to find behavior, not to read content.
- Per-user, peer, and endpoint baselines over supported process, command, authentication, DNS/network aggregate, inventory, and removable-media features
- Correlated storylines that connect related deviations across days
- Privilege drift, scope drift, and temporal drift on the same primary identity
- AI-generated verdict, evidence chain, and recommended next action - tenant-isolated
- Append-only application audit rows for covered analyst and response actions
- Read keystrokes
- Capture screenshots, webcam, or microphone
- Inspect file contents or private messages
- Take destructive endpoint actions without admin sign-off and a stated reason
- Cross tenant boundaries - every query is scoped to a single tenant
No keystrokes. No screenshots. No file contents.
Vedric minimizes content by design. The collector enforces the refusal list and the documented bounded PowerShell exception in agent code.
Read the full privacy stance →- No keystrokes
- No screenshots
- No webcam
- No microphone
- No file contents
- No private messages
Questions buyers ask first.
See insider risk before it becomes damage.
Early access is offered to security teams, IT leaders, and MSPs running production Windows fleets who want behavioral visibility without invasive monitoring. We review every request manually.