Vedric learns each user's behavioral baseline and flags the drift that EDR, SIEM, and UEBA miss.
No keystrokes, screenshots, or file payloads. The documented exception is a bounded, redacted PowerShell script preview.
Every agent message is cryptographically signed, so it is tamper-evident from endpoint to cloud.
Three audit surfaces reject edits and deletes by the application database role. Independent exports cover infrastructure-admin threat models.
Tenant-scoped queries and row-level database controls, exercised by build-time isolation tests.
We are selecting a small group of design partners. If insider risk is on your roadmap this year, contact us.
This example is a composite of behavior patterns Vedric detects in the days before an employee leaves. It is one anomaly pattern among several. Identifying details are removed. Specific thresholds are not published.
Normal. Working on the same projects the user has owned for two years.
baseline, no signal
First off-baseline activity. Query pattern outside the user's six-month norm.
deviation logged, not yet alerting
A first-time administrative command targets a system outside the recent project pattern.
command-scope drift, correlated with day 3
Normal working-hours activity. No further drift.
watching
Off-hours process and command activity increases in a time window the user has not worked before.
temporal deviation
Storyline correlated. Three deviations, same user, same endpoint, six days.
storyline created
Normal. User takes a half-day off.
watching
Privileged query not run in the last six months. The access is authorized; the timing is not normal for this user.
privilege drift
Another command targets a repository service outside the current team pattern.
command-scope drift, second instance
Egress volume above the user's personal baseline, outside their normal working hours.
exfiltration-shaped pattern
Employee submits resignation notice. HR is informed. The laptop is added to the return list.
Vedric had 11 days of warning
Vedric's baseline engine does not distinguish between malicious, accidental, and automated activity. It distinguishes normal behavior from abnormal behavior. This covers the three forms most incidents take.
A trusted user runs an unusual bulk-copy command and host-level outbound bytes rise sharply. That metadata justifies review without any malicious intent. Vedric does not claim which files or destination caused the volume.
A legitimate background task starts with a new command shape while the endpoint's new-destination count and frequency rise. Vedric correlates the process evidence with the endpoint baseline. It does not attribute host network bytes to that process without proof.
The login uses valid credentials and looks normal. After login, the behavior does not match the legitimate user: the access pattern, timing, and scope are different. Vedric compares activity against the user's own baseline, so a compromised account stands out from its owner's normal behavior.
Auditors ask how you would detect a resigning employee who spent two weeks preparing to leave with company material.
Most security programs cannot answer that. Their tools are built around external attackers, known-bad indicators, or aggregated log scoring. Insider preparation activity falls between those tools. Vedric is built to detect it.
Detecting an employee who is preparing to leave with data does not require reading their email. It requires behavioral data. Vedric is built around that distinction, and the agent enforces it in its own source code.
Set at agent install and re-verified on each collector pass
Enforced in code, not by policy.
Enforced on the agent. Cannot be extended remotely.
See how the platform is built, or read the pricing.
A 30-minute call with an engineer who builds Vedric. No slides.