Each timeline below is a composite of behavioral patterns Vedric reads in the days before an incident. The timelines show the activity that leads up to each incident, not the incident itself. Identifying details are removed. Specific thresholds are kept inside the product.
This is the most common insider scenario by far. There is no credential abuse, malware, or unauthorized access. A legitimate user’s activity patterns change before a departure they have not yet announced. The data egress confirms the pattern. It is not what triggers detection.
Normal. Working on the same projects they have owned for two years.
baseline, no signal
Identity behaves outside its long-term pattern. Activity differs from the user’s own six-month norm.
personal-baseline deviation
Access broadens beyond the typical scope of the peer group. Same role, wider access.
peer-cohort deviation
Normal working-hours activity. No further drift today.
watching
Activity moves into a time window the identity has not used in the prior six months.
temporal deviation
Three independent deviations are correlated to the same identity over six days. A storyline is formed.
storyline correlated
Data-gathering pattern on the endpoint. Unusual archive activity not seen on this device before.
data-staging signal
Access reaches into areas outside the user’s current team responsibilities.
scope-drift, second instance
Volume of outbound activity exceeds this identity’s personal baseline, during hours they don’t normally work.
exfiltration-shaped pattern
Employee submits resignation notice. HR is informed.
(Vedric had twelve days of warning)
Vedric saw 7 / 10 days
Twelve days of warning before the resignation meeting was scheduled.
The login is legitimate. The credentials are valid. Multi-factor authentication was satisfied. Every perimeter check passed. What changes is the behavior after login, and that behavior does not match the person who owns the account.
Privileged login from a familiar device. Routine administrative work.
baseline, no signal
Post-login behavior does not match the owner’s long-term pattern. Same identity, different operator cadence.
personal-baseline deviation
Privilege exercised in an area this admin has not touched in over six months.
privilege-drift signal
Activity diverges from the peer cohort of admins with the same role and scope.
peer-cohort deviation
Quiet day. Routine work appears to resume.
watching
Reconnaissance-like activity across systems the account has rights to but rarely visits.
discovery shape
Storyline correlated across three baselines: identity, peer, endpoint. All three deviate from normal.
storyline materialized
Privileged action would have run today.
(Vedric had five days of warning)
Vedric saw 5 / 8 days
Five days of behavioral warning before the privileged action.
The contractor was scoped narrowly for a specific project. Access works exactly as designed for ninety days. In the final week, the way the access is used changes, but the access itself does not. The contract is ending, and the activity looks like preparation for after it ends.
Normal end-of-project activity. Wrap-up tasks consistent with the contractor’s scoped role.
baseline, no signal
First-time administrative command targets an adjacent project system not seen during the engagement.
command-scope drift
Activity shape diverges from the cohort of other contractors finishing engagements.
peer-cohort deviation
Unusual archive activity on this endpoint. Data-gathering pattern not present in the prior ninety days.
data-staging signal
Quiet day. Stand-up attended, normal cadence.
watching
Activity drifts into off-hours windows the contractor never used during the engagement.
temporal deviation
Three deviations correlate to the same identity in the final week of an ending engagement.
storyline correlated
Off-boarding ticket filed. Account scheduled for deactivation.
(Vedric had four days of warning)
Vedric saw 5 / 8 days
Four days of warning before the off-boarding ticket was filed.
Executives have the broadest access and the least peer-cohort signal. There are only a handful of peers, and their patterns are irregular by nature. Vedric relies on the executive’s own long-term baseline. When current activity departs from that baseline, the pattern shows even when peer data is thin.
Normal executive activity. Travel, calendar, strategy documents in the usual rhythm.
baseline, no signal
Identity behaves outside its long-term pattern. Access cadence changes in pattern, not in volume.
personal-baseline deviation
First-time archive utility and a sensitive-extension inventory change appear on the executive endpoint; no file read is inferred.
staging metadata
Normal day. Board prep activity consistent with calendar.
watching
Activity moves into a time window the identity has not used in the prior twelve months.
temporal deviation
Commands begin naming strategy systems outside this executive’s recent endpoint pattern.
command-scope drift
Storyline correlated. Multiple baselines disagree with normal for the same identity.
storyline materialized
Unusual archive activity on the executive endpoint during hours outside the working calendar.
pre-departure staging shape
Executive announces departure for competitor.
(Vedric had nine days of warning)
Vedric saw 6 / 9 days
Nine days of warning before the departure announcement, which moved the share price.
Early access is offered to security teams, IT leaders, and MSPs who want behavioral visibility without invasive monitoring. We review every request manually.