Most insider threats start as normal-looking activity.
The damaging part of an insider incident is rarely a malicious binary. It is a valid login followed by behavior that drifts off the user's own pattern. Vedric is built to read that drift across endpoints, without reading content.
THE PROBLEM
A threat from inside does not look like an attack on day one.
It looks like a slightly longer evening. A query that used to be quarterly running weekly. A new destination that was not on any blocklist. A scheduled task created by an account that has the rights to create it. By the time the activity is obvious in retrospect, the data has already moved. Insider threat detection software has to read the early shape of the pattern, not wait for the loud event.
Tools built for outside attackers miss insiders.
AV and EDR scoring rests on whether the binary, the hash, or the IoC is known. An employee with legitimate access does not need any of those. Indicator-based tools have nothing to score.
DLP triggers on rule matches. A user staging copies of files they have access to, in formats they normally use, will not match a rule. Insider behavior bends within policy until it bends past it.
Threshold-based monitoring on noisy primitives (every off-hours login, every elevated command) drowns SOCs. The high-signal pattern is correlation across days, not alerting on every primitive.
SIEM queries are excellent at "show me what this user did last week", once you already know to ask. They are not built to surface "this user is trending off their own baseline" before the question is asked.
Vedric scores deviation, not intent.
A deviation is a deviation regardless of who caused it. The same engine flags an honest mistake, a drifting service account, and a borrowed credential, because all three look the same to a baseline that knows what normal is for that primary identity.
Three shapes, one detection
Vedric does not need to decide whether the user is malicious, careless, or compromised. The system flags off-baseline behavior; humans interpret intent. That separation is what makes the alert defensible to legal and HR.
Pattern over time, not threshold per event
A single off-hours login is a footnote. Three correlated deviations on the same user, endpoint, and project, over six days, is a storyline. Vedric promotes correlated patterns and quietly logs the rest.
Append-only evidence chain for every alert
When an analyst acts, the action, the reason, the AI verdict, and every tool call run by the triage agent are written to an append-only audit trail. Insider incidents almost always end up in front of a lawyer; Vedric is built so the trail holds up.
EXAMPLE SCENARIO · TIMELINE
A contractor whose scope quietly expands.
The contractor was scoped narrowly for a single project. Their access was set up correctly. Over a few weeks, the systems they touch begin to drift outside the project envelope.
- T+01T+01 - contractor logs in and works on the assigned project. Baseline accumulates over the warm-up period.
- T+02T+12 - contractor starts pulling code from a repository unrelated to their scope. Single event. Logged as a deviation.
- T+03T+15 - they query a database in another department. The query runs because they have rights, but no one ever scoped this in.
- T+04T+19 - repeated cross-scope access in a new pattern. Three deviations on the same identity. Storyline materializes.
- T+05T+20 - Vedric surfaces the storyline. The analyst sees one alert with a complete evidence chain across the four out-of-scope events.
- T+06T+21 - admin-gated response: contractor session terminated, scope reviewed, audit trail exported.
No malware. No policy violation by traditional rules. No alert from EDR, SIEM, or DLP. The signal was the shape of the access drifting outside the contractor's scope, the kind of pattern only a per-identity baseline can read.
What you see, and what you do not.
- Behavioral storylines per primary identity, with full deviation chain
- Privilege drift, scope drift, temporal drift, and egress drift correlated together
- AI-generated verdict and recommended action with a tenant-isolated tool layer
- Append-only audit trail of every detection, response, and analyst action
- Per-tenant configuration of what response actions require admin sign-off
- Capture content from screens, files, messages, or audio
- Treat "intent" as something the platform claims to know
- Allow tools to act on the endpoint without a stated reason and admin approval
- Share data across tenants
- Run detection on a tenant whose agent has stopped checking in
No keystrokes. No screenshots. No file contents.
Vedric is metadata-only by design. The collector enforces these limits at the source code of the agent.
Read the full privacy stance →- No keystrokes
- No screenshots
- No webcam
- No microphone
- No file contents
- No private messages
Questions buyers ask first.
Catch the insider pattern before the loud event.
Early access is offered to teams who want behavioral detection at the endpoint without invasive monitoring. We review every request to make sure Vedric is a fit.