Privileged access is the riskiest kind of normal.
A privileged account is, by design, allowed to do almost anything. That makes the difference between routine privileged work and dangerous privileged work invisible to entitlement-based controls. Vedric reads the behavioral shape underneath the privilege.
THE PROBLEM
Permissions tell you what they can do. Behavior tells you what they did.
PAM and identity tooling decide what privileged users are allowed to do. Once that gate is open, the difference between routine elevation and dangerous elevation lives entirely in behavior: when it happens, on which systems, with which commands, against which data. Without a behavioral baseline on those primitives, every privileged action looks the same.
Why entitlements alone are not visibility.
Decides who can elevate and brokers the credentials. It does not score the resulting behavior. A legitimate elevation followed by a command sequence the user has not run in six months is still an approved elevation as far as PAM is concerned.
Captures content. Generates terabytes nobody watches. Surfaces nothing in real time. By the time someone scrubs the recording, the action has been taken.
Tell you the action was approved. They do not tell you that this approval, on this user, on this day, sits outside the user historical pattern.
Block lists are brittle. Admin tooling is too varied, and the privileged commands that matter are usually built into the OS or the cloud provider, not on a list.
A baseline for what privilege normally looks like.
Vedric runs the same per-user, per-peer, and per-endpoint baselines on privileged accounts as it does on standard ones, but the storyline weighting is different. Privileged scope drift, privileged temporal drift, and privileged command drift all promote earlier, because the cost of missing is higher.
Higher cost of missing, lower threshold to alert
A privileged account running a command outside its six-month pattern is treated as a stronger signal than the same command from an unprivileged user. Vedric promotes privileged drift earlier in the storyline lifecycle.
Not the command. The shape of the command.
Whether the command is encoded, off-hours, run on systems outside the user normal scope, or in an unusual sequence - those modifiers, not the command itself, are what matter for a privileged user.
Every detection ties back to an append-only evidence chain
Privileged incidents end up in front of legal, the board, or a regulator. Vedric writes detection, AI verdict, and analyst response to an append-only audit trail with database-level mutation refused, so the chain holds up later.
EXAMPLE SCENARIO · TIMELINE
A domain admin whose Tuesday is suddenly different.
A domain admin who has worked the same shift for two years runs a sequence of commands at the start of an evening that nobody on the team would have flagged in isolation.
- T+01T+01 - typical workday pattern. Baseline solid across the user privileged primitives.
- T+02T+02 18:40 - domain admin runs a privileged query that has not been seen on this account in the last six months. Single event, logged.
- T+03T+02 18:55 - same admin accesses a sensitive file share from a workstation they never use for privileged work.
- T+04T+02 19:30 - temporal deviation: privileged activity outside the user normal evening window.
- T+05T+02 19:45 - multiple correlated deviations on a privileged identity. Storyline materializes immediately at high confidence; promoted earlier for privileged accounts.
- T+06T+02 19:46 - Vedric surfaces the storyline, AI verdict flags it as critical, recommended action is "isolate session pending admin review."
The action that would normally take a domain admin minutes to execute is interrupted by an admin-gated response. The storyline, the verdict, and every tool call by the triage agent are written to an append-only audit trail before any action is taken.
Privilege-aware detection without session recording.
- Per-user behavioral baselines on privileged primary identities
- Earlier promotion of privileged storylines reflecting higher cost-of-miss
- Privileged command, scope, and temporal drift weighted independently
- Tenant-isolated AI triage with read-only tools and admin-gated response
- Append-only audit trail of privileged detections and actions
- Record privileged sessions, screen content, or keystrokes
- Maintain a static block list of privileged commands as the primary control
- Allow tools to take action against the endpoint without admin approval and a stated reason
- Distinguish "privileged surveillance" from regular monitoring - there is no hidden lower-privacy mode
- Replace your PAM. PAM brokers entitlements; Vedric reads behavior
No keystrokes. No screenshots. No file contents.
Vedric is metadata-only by design. The collector enforces these limits at the source code of the agent.
Read the full privacy stance →- No keystrokes
- No screenshots
- No webcam
- No microphone
- No file contents
- No private messages
Questions buyers ask first.
Privilege you can defend behaviorally.
Early access is for teams whose privileged accounts are well-controlled at the entitlement layer and want a behavioral signal underneath that PAM cannot give them.