MSPs need insider risk detection across unrelated client environments without sharing raw tenant data or using invasive surveillance collectors. Vedric keeps customer records and primary baselines scoped to each tenant. An optional, thresholded global fallback uses aggregate statistics only and can be disabled per tenant.
Currently supports Windows endpoints.
An MSP that turns on surveillance-grade collectors across client environments takes on the legal and reputational risk of every client at once. A breach of content data collected by the MSP is several breaches in one. MSPs still need real visibility into client behavior, not just patch status. Vedric minimizes collection to behavioral telemetry, explicitly discloses the bounded PowerShell script-preview exception, and enforces tenant boundaries around customer records.
Many "multi-tenant" tools expose raw data or unconstrained models across client boundaries. MSPs need customer records, ordinary baselines, queries, and response actions bound to one tenant, with any aggregate fallback narrowly thresholded and opt-out capable.
Tools that capture screens, keystrokes, or file contents create liability that grows with the number of clients. One breach on the MSP side is a multi-client incident.
Threshold-based stacks cause alert fatigue at one tenant. Across a fleet, the volume becomes impossible to review. MSPs need correlated storylines, not raw events.
A baseline trained across all tenants is not a real baseline. It is a smoothed average that catches almost nothing. Per-tenant, per-user baselines are the only way to detect drift at each client.
Vedric is multi-tenant from the data layer up. Customer telemetry, personal and tenant peer baselines, storylines, and AI tool calls are tenant-scoped. A global fallback can use aggregate statistics only after at least five tenants qualify, with at least three verified users per contributing tenant cohort. A tenant can opt out of both contributing to and using the fallback. The MSP operator sees client environments as separate spaces with separate audit trails.
Telemetry, personal and tenant peer baselines, storylines, and AI tool calls are tenant-scoped. Only thresholded aggregate baseline statistics can feed the optional global fallback. Raw telemetry and user identifiers do not cross tenant boundaries.
The agent does not capture screens, keystrokes, audio, or document or file bodies. When PowerShell Script Block Logging is available, it can collect a best-effort, credential-scrubbed preview of up to 2,048 bytes of script text plus a fixed truncation marker. That bounded content exception should be included in every client notice.
The MSP operator sees a per-tenant storyline view and an aggregate fleet view with storyline counts and severity per client, without per-tenant content. Each tenant's admin can read their own audit trail.
The MSP runs Vedric across 40 client tenants. Per-client baselines have matured. The fleet view shows quiet activity across most tenants and one storyline that formed overnight at a specific client.
The MSP saw one signal across 40 clients without access to any other client's raw tenant records. The client received an exportable storyline and audit record with the handoff.
Vedric is designed to minimize content collection. The agent code enforces the list of refused collectors and the documented, bounded PowerShell exception.
Read the full privacy stanceEarly access is available to MSPs running production Windows fleets across multiple client environments who want behavioral visibility without taking on content-collection liability.