Four scenarios. Forty-something days of warning.
Each timeline below is a composite of behavioral shapes Vedric reads in the days leading up to an incident. None of these are the loud event. All four are the quiet rehearsal that precedes it. Identifying details removed. Specific thresholds stay inside the product.
The employee collecting material the two weeks before they resign.
This is the most common insider scenario by far. No credential abuse, no malware, no unauthorized access - just a legitimate user whose patterns quietly change in the run-up to a departure they have not yet announced. The egress is the confirmation, not the trigger.
- DAY 01Normal. Working on the same projects they have owned for two years.baseline · no signal-
- DAY 03Identity behaving outside its long-term pattern. Activity shape drifts from the user’s own six-month norm.personal-baseline deviationVEDRIC
- DAY 05Access broadening beyond peer-group typical scope. Same role, different breadth.peer-cohort deviationVEDRIC
- DAY 06Normal working-hours activity. No further drift today.watching-
- DAY 08Activity drifts into a time window the identity has not used in the prior six months.temporal deviationVEDRIC
- DAY 09Three independent deviations correlate to the same identity over six days. Storyline materializes.storyline correlatedVEDRIC
- DAY 11Material-gathering shape on the endpoint. Unusual archive activity not seen on this device before.data-staging signalVEDRIC
- DAY 12Access reaches into areas outside the user’s current team responsibilities.scope-drift, second instanceVEDRIC
- DAY 13Volume of outbound activity exceeds this identity’s personal baseline, during hours they don’t normally work.exfiltration-shaped patternVEDRIC
- DAY 14Employee submits resignation notice. HR is informed.(Vedric had twelve days of warning)-
A privileged account behaving like a stranger inside it.
The login is legitimate. The credentials are valid. Multi-factor was satisfied. Everything the perimeter is built to check, passed. What changes is the behavior on the other side of the door - and that behavior looks nothing like the human who owns the account.
- DAY 01Privileged login from a familiar device. Routine administrative work.baseline · no signal-
- DAY 02Post-login behavior shape doesn’t match the owner’s long-term pattern. Same identity, different operator cadence.personal-baseline deviationVEDRIC
- DAY 03Privilege exercised in an area this admin has not touched in over six months.privilege-drift signalVEDRIC
- DAY 04Activity shape diverges from the peer cohort of admins with the same role and scope.peer-cohort deviationVEDRIC
- DAY 05Quiet day. Routine work resumes on the surface.watching-
- DAY 06Reconnaissance-shaped activity across systems the account has rights to but rarely visits.discovery shapeVEDRIC
- DAY 07Storyline correlated across three baselines: identity, peer, endpoint. All three disagree with normal.storyline materializedVEDRIC
- DAY 08Privileged action would have run today.(Vedric had five days of warning)-
End-of-engagement data harvest from a scoped account.
The contractor was scoped narrowly for a specific project. Access works exactly as designed for ninety days. In the final week, the shape of how the access is used changes - not the access itself. The contract is ending; the behavior is preparing for after the contract ends.
- DAY 01Normal end-of-project activity. Wrap-up tasks consistent with the contractor’s scoped role.baseline · no signal-
- DAY 02Identity reaching into adjacent project areas it had rights to but had not used during the engagement.scope-drift signalVEDRIC
- DAY 03Activity shape diverges from the cohort of other contractors finishing engagements.peer-cohort deviationVEDRIC
- DAY 04Unusual archive activity on this endpoint. Material-gathering shape not present in the prior ninety days.data-staging signalVEDRIC
- DAY 05Quiet day. Stand-up attended, normal cadence.watching-
- DAY 06Activity drifts into off-hours windows the contractor never used during the engagement.temporal deviationVEDRIC
- DAY 07Three deviations correlate to the same identity in the final week of an ending engagement.storyline correlatedVEDRIC
- DAY 08Off-boarding ticket filed. Account scheduled for deactivation.(Vedric had four days of warning)-
M&A and competitor-move staging from inside the boardroom.
Executives have the broadest access and the least peer-cohort signal - there are only a handful of peers, and their patterns are inherently irregular. Vedric leans on the executive’s own long-term baseline. When that baseline starts disagreeing with the present, the pattern shows even when the peer view is thin.
- DAY 01Normal executive activity. Travel, calendar, strategy documents in the usual rhythm.baseline · no signal-
- DAY 04Identity behaving outside its long-term pattern. Access cadence shifts in shape, not in volume.personal-baseline deviationVEDRIC
- DAY 05Material-gathering shape on the executive endpoint. Sensitive documents touched in an unusual order.data-staging signalVEDRIC
- DAY 06Normal day. Board prep activity consistent with calendar.watching-
- DAY 07Activity drifts into a time window the identity has not used in the prior twelve months.temporal deviationVEDRIC
- DAY 08Access broadening into strategy areas outside this executive’s usual remit.scope-drift signalVEDRIC
- DAY 10Storyline correlated. Multiple baselines disagree with normal for the same identity.storyline materializedVEDRIC
- DAY 11Unusual archive activity on the executive endpoint, into hours outside the working calendar.pre-departure staging shapeVEDRIC
- DAY 12Executive announces departure for competitor.(Vedric had nine days of warning)-
Map your scenario to a timeline.
Early access is offered to security teams, IT leaders, and MSPs who want behavioral visibility without invasive monitoring. We review every request manually.