How does Vedric Detect pricing work?

Vedric Detect is priced per protected endpoint: $12 per endpoint per month, or $120 per endpoint per year when billed annually, which gives two months free. You are billed for the endpoints you actually protect and can change that count at any time.

How long does it take to deploy Vedric Detect?

The Vedric Detect agent installs in under 5 minutes per endpoint. A GUI installer or silent enterprise deployment command handles everything. No infrastructure changes or reboots required.

What operating systems does Vedric Detect support?

Vedric Detect supports Windows 10, Windows 11, and Windows Server 2016+ endpoints today.

How is data stored and protected?

All data is encrypted at rest and in transit. Tenant data is fully isolated. Vedric enforces two-factor authentication and role-based access controls for all dashboard users.

What is insider threat detection?

Insider threat detection identifies security risks from people who already have authorized access to your systems, employees, contractors, and partners. Vedric Detect uses behavioral analytics to learn normal patterns and flag anomalies that could indicate data theft, credential compromise, or policy violations.

Can Vedric run alongside an existing UEBA?

Yes. Vedric is designed to forward correlated storylines into a SIEM or UEBA as enriched events. The two layers see different surfaces; together they have more signal than either alone.

Does Vedric replace SIEM?

No. SIEM is a search and storage layer. Vedric is a detection layer. They are complementary Vedric storylines often end up in SIEM as a single high-quality enriched alert.

How are peer groups derived if not from AD?

Peer groups start from AD or HR metadata and are updated by observed behavioral similarity. A user whose actual access pattern has moved away from their stated department will be reclustered, and the cohort baseline stays meaningful.

Is the platform multi-tenant?

Yes. Tenant isolation is enforced at the database, the AI triage tools, and the admin surface. There is no cross-tenant query path. This matters for MSPs and for any org running multiple business units on shared infrastructure.

How fast does Vedric produce alerts?

Per-device personal-baseline warm-up before alerts fire. During warm-up we lean on mature role/peer baselines from the tenant where they exist; on a fresh device with no peer cohort yet, alerts are suppressed. After warm-up, the cadence is driven by actual storyline materialization, not by threshold spam.

Vedric

Join the waitlist

UEBA ALTERNATIVE

UEBA scores logins. Vedric reads endpoints.

User and Entity Behavior Analytics is usually a scoring layer on authentication logs. Vedric adds endpoint process and command metadata, security-event cadence, DNS/network aggregates, sensitive-extension inventory and removable-media writes.

Request Early Access View PlatformWindows endpoints today.

THE PROBLEM

Most UEBA is a dashboard on top of authentication logs.

It surfaces who logged in, when, from where, and how often. That signal is real. It is also a small slice of endpoint behavior. Process launches, command-line shapes, authentication-event cadence, DNS history and host-level network drift happen below that auth layer. Vedric does not claim per-file reads or content inspection.

WHY CURRENT APPROACHES FALL SHORT

The signal a UEBA cannot reach.

AUTH-CENTRIC

Most UEBA inputs are AD events, VPN logs, and SSO sessions. The user looks normal at login; the divergence is what they do after login. UEBA does not have endpoint primitives in its index.

AGGREGATED EVENTS

Log aggregation collapses behavior into counts and sessions. A specific PowerShell command run with specific arguments, in a specific timeline, against a specific peer baseline that fidelity is lost in aggregation.

STATIC PEER GROUPS

Peer clusters are often defined by AD group membership and rarely re-cluster. A user whose actual behavior shifts away from their peers will keep being scored against the wrong cohort.

NO CORRELATION OVER TIME

UEBA scores tend to be per-event or per-session. The high-value signal is correlation across days a pattern UEBA modules typically only surface in retrospective hunts, not as a live alert.

HOW VEDRIC HELPS

Endpoint primitives, correlated, with a real evidence chain.

Vedric collects endpoint process, command, authentication, DNS/network aggregate, sensitive-extension inventory and removable-media metadata, then correlates supported deviations across user, peer and endpoint contexts.

01 /LOWER LAYER

Behavior at the endpoint, not auth

The agent reads the user's behavior at the layer where the action actually happens. Login is a footnote. The story is what the session does once it is open.

02 /DRIFT-AWARE

Re-clustering peer baselines

Peer groups are derived from observed behavior in addition to organizational metadata. A user who has actually moved roles is reclustered. The cohort comparison stays meaningful as the org changes.

03 /CROSS-DAY

Storylines across the calendar

A deviation on Monday and a deviation on Friday on the same identity are correlated into one storyline if the underlying pattern matches. Single events are footnotes; storylines are alerts.

EXAMPLE SCENARIO · TIMELINE

A privileged user whose pattern bends quietly.

A senior engineer with broad access starts working slightly later, runs slightly more queries, and touches a few systems they have not touched in months each event individually well within their entitlements.

T+01
T+02 - UEBA: nothing. Login pattern still inside normal range. Vedric: logs first off-baseline command on the user personal baseline.
T+02
T+05 - UEBA: nothing. Auth source unchanged. Vedric: a first-time share-enumeration command targeted a system outside the user recent pattern.
T+03
T+08 - UEBA: nothing. Vedric: temporal deviation. User worked outside their personal hours window.
T+04
T+09 - UEBA: nothing. Vedric: multiple correlated deviations on the same identity. Storyline materializes.
T+05
T+11 - UEBA: low score uptick on session count. Vedric: privilege drift added command not seen in the last six months.
T+06
T+12 - UEBA: still no actionable alert. Vedric: storyline now contains five correlated deviations and is at high confidence. Single alert reaches the analyst.

OUTCOME

Same user, same auth pattern, same SSO source. UEBA had no actionable surface because none of the auth dimensions changed enough. Vedric saw the behavior beneath the login.

WHERE VEDRIC AND UEBA DIFFER

A different signal because it is a different surface.

VEDRIC SURFACES

Endpoint-native metadata: process, command, sensitive-extension inventory, removable-media writes, network, DNS, authentication
Per-user, per-peer, per-endpoint baselines computed on raw behavior, not log aggregates
Multi-day correlated storylines as the primary alert unit
Tenant-isolated AI triage with verdict, evidence chain, and recommended action
Append-only application audit rows for covered analyst and response actions

VEDRIC DOES NOT DO

Score authentication logs as the primary input
Aggregate behavior into session-level counts before scoring
Rely on AD group membership for peer clustering
Replace your SIEM many teams forward Vedric storylines into SIEM as enriched events
Read screen content, file contents, keystrokes, audio, or private messages

PRIVACY-FIRST BY DEFAULT

No keystrokes. No screenshots. No file contents.

Vedric minimizes content by design. The collector enforces the refusal list and the documented bounded PowerShell exception in agent code.

Read the full privacy stance →

No keystrokes
No screenshots
No webcam
No microphone
No file contents
No private messages

FREQUENTLY ASKED

Questions buyers ask first.

PLATFORM

Behavioral security platform

How three baselines combine into a single storyline.

OVERVIEW

Insider risk detection

The flagship use case for endpoint-first behavioral detection.

USE CASE

Data exfiltration detection

How behavioral indicators precede unauthorized data movement.

Read the behavior. Not just the login.

Early access is offered to teams whose UEBA is not telling them what they need and who want endpoint-first behavioral signal as a complement, not a replacement.

Request Early Access Talk to security teamResponse within one business day.