Insider incidents rarely involve a malicious binary. They usually start with a valid login, followed by behavior that drifts from the user's own pattern. Vedric detects that drift with content-minimizing collectors. The one disclosed exception is a bounded PowerShell script preview.
Currently supports Windows endpoints.
Early signs are small: a slightly longer working evening, a query that used to run quarterly now running weekly, or an endpoint whose count of new network destinations rises alongside a first-time command. These metadata changes can justify a review before an obvious incident. On their own, they do not prove data theft.
AV and EDR scoring depends on whether the binary, hash, or IoC is known. An employee with legitimate access needs none of these, so indicator-based tools have nothing to score.
DLP triggers on rule matches. A user staging copies of files they have access to, in formats they normally use, will not match a rule. Insider behavior often stays within policy until it crosses it.
Threshold-based monitoring on noisy events, such as every off-hours login or every elevated command, overwhelms SOCs. The useful signal is correlation across days, not an alert on every single event.
SIEM queries work well for "show me what this user did last week" once you know to ask. They are not built to show that a user is trending away from their own baseline before anyone asks.
Vedric scores deviation, not intent. A deviation counts the same no matter who caused it. The same engine flags an honest mistake, a drifting service account, and a borrowed credential, because all three look the same to a baseline of what is normal for that primary identity.
Vedric does not decide whether a user is malicious, careless, or compromised. It flags off-baseline behavior, and people interpret intent. This separation is what makes the alert defensible to legal and HR.
A single off-hours login is minor. Three correlated deviations on the same user, endpoint, and project over six days form a storyline. Vedric promotes correlated patterns and logs the rest without alerting.
When an analyst takes a covered sensitive action, Vedric records the actor, reason, and relevant response context in audit rows that the application role cannot update or delete. Alert and storyline records remain operational records. We do not claim that every detection row is cryptographically immutable.
A contractor was given narrow access for a single project, and the access was set up correctly. Over a few weeks, the systems they touch start to fall outside that project.
No malware, no policy violation under traditional rules, and no alert from EDR, SIEM, or DLP. The signal was the contractor's access moving outside their scope. Only a per-identity baseline can detect this kind of pattern.
Vedric is designed to minimize content collection. The agent code enforces the list of refused collectors and the documented, bounded PowerShell exception.
Read the full privacy stanceEarly access is open to teams who want behavioral detection on the endpoint without invasive monitoring. We review every request to make sure Vedric is a fit.