A privileged account is allowed to do almost anything by design. Entitlement-based controls therefore cannot tell routine privileged work from dangerous privileged work. Vedric reads the behavior behind the privilege.
Currently supports Windows endpoints.
Permissions show what users can do. Behavior shows what they did. PAM and identity tools decide what privileged users are allowed to do. Once access is granted, the difference between routine and dangerous elevation shows up only in behavior: when it happens, on which systems, with which commands, and against which data. Without a behavioral baseline on those events, every privileged action looks the same.
PAM decides who can elevate and brokers the credentials. It does not score the behavior that follows. A legitimate elevation followed by commands the user has not run in six months is still an approved elevation as far as PAM is concerned.
Session recording captures content and generates terabytes that nobody watches. It surfaces nothing in real time. By the time someone reviews the recording, the action has already been taken.
These show that an action was approved. They do not show that this approval, for this user, on this day, falls outside the user's historical pattern.
Block lists are brittle. Admin tooling varies too much, and the privileged commands that matter are usually built into the OS or the cloud provider, not on a list.
Vedric runs the same per-user, per-peer, and per-endpoint baselines on privileged accounts as on standard ones, with different storyline weighting. Privileged scope drift, temporal drift, and command drift all promote earlier because the cost of missing them is higher.
A privileged account running a command outside its six-month pattern counts as a stronger signal than the same command from an unprivileged user. Vedric promotes privileged drift earlier in the storyline lifecycle.
For a privileged user, the modifiers matter more than the command itself: whether it is encoded, run off-hours, run on systems outside the user's normal scope, or part of an unusual sequence.
Vedric records covered privileged analyst and response actions in audit rows whose UPDATE and DELETE operations are refused to the application role. Detection and storyline rows remain operational records. Threat models that include the infrastructure owner require independently retained exports.
A domain admin has worked the same shift for two years. At the start of a Tuesday evening, they run a sequence of commands that nobody on the team would have flagged individually.
An action that would normally take a domain admin minutes to carry out is surfaced for an admin-gated response. The response request and its reason are recorded before delivery. A separate outcome record is appended after the endpoint acknowledges it.
Vedric is designed to minimize content collection. The agent code enforces the list of refused collectors and the documented, bounded PowerShell exception.
Read the full privacy stanceEarly access is for teams whose privileged accounts are well controlled at the entitlement layer and who want a behavioral signal that PAM cannot provide.