Most insider threats start as normal-looking activity.
The damaging part of an insider incident is rarely a malicious binary. It is a valid login followed by behavior that drifts off the user's own pattern. Vedric is built to read that drift with content-minimizing collectors and one disclosed bounded PowerShell script-preview exception.
THE PROBLEM
A threat from inside does not look like an attack on day one.
It looks like a slightly longer evening, a query shape that was once quarterly running weekly, or an endpoint whose new-destination count rises beside a first-time command. Those metadata changes can justify review before a loud incident, but they do not by themselves prove data theft.
Tools built for outside attackers miss insiders.
AV and EDR scoring rests on whether the binary, the hash, or the IoC is known. An employee with legitimate access does not need any of those. Indicator-based tools have nothing to score.
DLP triggers on rule matches. A user staging copies of files they have access to, in formats they normally use, will not match a rule. Insider behavior bends within policy until it bends past it.
Threshold-based monitoring on noisy primitives (every off-hours login, every elevated command) drowns SOCs. The high-signal pattern is correlation across days, not alerting on every primitive.
SIEM queries are excellent at "show me what this user did last week", once you already know to ask. They are not built to surface "this user is trending off their own baseline" before the question is asked.
Vedric scores deviation, not intent.
A deviation is a deviation regardless of who caused it. The same engine flags an honest mistake, a drifting service account, and a borrowed credential, because all three look the same to a baseline that knows what normal is for that primary identity.
Three shapes, one detection
Vedric does not need to decide whether the user is malicious, careless, or compromised. The system flags off-baseline behavior; humans interpret intent. That separation is what makes the alert defensible to legal and HR.
Pattern over time, not threshold per event
A single off-hours login is a footnote. Three correlated deviations on the same user, endpoint, and project, over six days, is a storyline. Vedric promotes correlated patterns and quietly logs the rest.
Covered analyst actions get append-only audit rows
When an analyst takes a covered sensitive action, Vedric records the actor, reason, and relevant response context in audit rows that the application role cannot update or delete. Alert and storyline records remain operational records; this is not a claim that every detection row is cryptographically immutable.
EXAMPLE SCENARIO · TIMELINE
A contractor whose scope quietly expands.
The contractor was scoped narrowly for a single project. Their access was set up correctly. Over a few weeks, the systems they touch begin to drift outside the project envelope.
- T+01T+01 - contractor logs in and works on the assigned project. Baseline accumulates over the warm-up period.
- T+02T+12 - contractor starts pulling code from a repository unrelated to their scope. Single event. Logged as a deviation.
- T+03T+15 - they query a database in another department. The query runs because they have rights, but no one ever scoped this in.
- T+04T+19 - repeated cross-scope access in a new pattern. Three deviations on the same identity. Storyline materializes.
- T+05T+20 - Vedric surfaces the storyline. The analyst sees one alert with a complete evidence chain across the four out-of-scope events.
- T+06T+21 - admin-gated response: contractor session terminated, scope reviewed, audit trail exported.
No malware. No policy violation by traditional rules. No alert from EDR, SIEM, or DLP. The signal was the shape of the access drifting outside the contractor's scope, the kind of pattern only a per-identity baseline can read.
What you see, and what you do not.
- Behavioral storylines per primary identity, with full deviation chain
- Privilege drift, scope drift, temporal drift, and egress drift correlated together
- AI-generated verdict and recommended action with a tenant-isolated tool layer
- Append-only application audit rows for covered sensitive analyst and response actions
- Per-tenant configuration of what response actions require admin sign-off
- Capture content from screens, files, messages, or audio
- Treat "intent" as something the platform claims to know
- Allow tools to act on the endpoint without a stated reason and admin approval
- Share data across tenants
- Run detection on a tenant whose agent has stopped checking in
No keystrokes. No screenshots. No file contents.
Vedric minimizes content by design. The collector enforces the refusal list and the documented bounded PowerShell exception in agent code.
Read the full privacy stance →- No keystrokes
- No screenshots
- No webcam
- No microphone
- No file contents
- No private messages
Questions buyers ask first.
Catch the insider pattern before the loud event.
Early access is offered to teams who want behavioral detection at the endpoint without invasive monitoring. We review every request to make sure Vedric is a fit.