Insider threat detection software

What an insider threat is, and why it is hard to spot

An insider threat is a risk that comes from someone inside your organisation: an employee, a contractor or a supplier with a login. Teramind's own knowledge base splits them into two groups:

• Malicious insiders: people who deliberately misuse their access, for example to take customer lists to a competitor, sabotage systems or commit fraud.
• Negligent users: people who cause a breach by accident, such as uploading a file to personal cloud storage, emailing the wrong attachment or pasting confidential text into an AI chat.

Both are hard to catch with perimeter tools. Firewalls, email filters and antivirus are built to keep outsiders out, and an insider is already inside with valid credentials. Their activity looks like normal work until you can see it in context: who opened what, where it went next and whether that fits their usual pattern.

A third group matters too: compromised accounts and automated agents. A stolen password or an AI agent running on a work laptop acts with the same rights as the person it belongs to. Teramind now monitors agentic AI on the endpoint as well as people; see employee AI usage monitoring.

How Teramind detects insider threats

Teramind is endpoint-based. An agent on each Windows, macOS or Linux computer records the activity your policy allows and enforces your rules on the computer itself (see the Teramind agent). Detection then works in layers:

1. Visibility. Activity dashboards for applications and websites, emails, instant messages, file events, printing and console commands show how data is handled. Teramind's guide gives examples such as spotting a user who suddenly runs system utilities or uses unapproved cloud storage.
2. Behaviour rules. A visual rules editor lets you define what risky looks like: uploading files to personal cloud drives, copying data to USB storage, mass forwarding of email to outside addresses, logging in out of hours, or trying to change system policies. Rules can combine user groups, schedules and content conditions.
3. Automated response. When a rule fires, the agent can warn the user, notify your security team, block the action, record video around the event, run a command or lock the user out. The milder actions are on every plan; Command, Lock Out User and Record Video start on UAM.
4. Risk scoring. Each rule carries a risk level you set, and Teramind multiplies it by how often the rule is broken, so one-off serious events and repeated small infractions both show up in the risk view.
5. Investigation. Every alert links to the Session Player, which replays the user's screen at the moment of the event, with the activity before and after it.

Teramind's pricing page lists anomaly detection and dynamic risk scoring from the UAM plan, and its insider threat page describes behaviour baselines for users and peer groups so that unusual deviations stand out. Rules are what you will tune most, and that is where we can help most.

The Insider Threat Detection dashboard and risk views

Teramind's preset Insider Threat Detection dashboard gathers the most common exfiltration signals in one place: file uploads, outgoing email attachments, outgoing instant message attachments, high-volume printing and keystrokes containing sensitive words. Widgets rank the people with the most activity in each channel, and each event row opens the recording at the exact moment it happened.

Alongside it:

• Behavior Alerts dashboard: a chronological record of every rule violation, with heatmaps and a Risk tab that ranks the riskiest users, rules and departments.
• Employee details: one view of a person's applications, websites, keystrokes and file transfers when an investigation needs context.
• Insights feed: Teramind's AI-assisted news-style feed (marketed as OMNI) groups similar events into cards, and Teramind lists insider risk scoring and persona baseline drift among its features. Teramind's knowledge base currently describes the Insights dashboard as a beta feature and advises against using it in production, so treat it as a supplement to rules rather than the basis of a programme.
• SIEM export: alerts can be sent to SIEM platforms such as Splunk, ArcSight, QRadar and Elastic; Teramind says this integration is currently configured through its Legacy interface.

The dashboard is available on every plan, but its widgets depend on the channels your plan records. File events, email, printing and keystrokes need the UAM plan or above, so Starter shows only part of the picture. The Teramind pricing and plans page sets out what each plan includes.

Forensic evidence: recordings, OCR and remote control

When an alert needs investigating, the questions are usually the same: what happened, was it deliberate and how far did it go? Teramind answers them with:

• Session recording and playback: a time-stamped video of the user's screen with an incident timeline, tags and notes for whoever is handling the case. See screen monitoring software for employees.
• Record only on rule violation: from UAM you can record video only around rule breaches instead of all day, which is far easier to justify under UK data protection law.
• OCR search: optical character recognition indexes text shown on screen so you can search recordings for a project name or a card number pattern. OCR is included on Enterprise and a paid add-on on the other plans.
• Remote control: in live view an authorised investigator can take control of the session or freeze input to stop an exfiltration attempt in progress.
• Exports: recordings and reports can be exported for HR, legal or a regulator.

Evidence is only useful if it was collected lawfully and handled carefully. Restrict who can open recordings with Teramind's role-based access control, set a retention period, and keep a record of who reviewed what. Take advice before relying on monitoring data in a disciplinary or legal process.

Insider threat detection under UK law

Protecting customer data and intellectual property is a recognised reason to monitor, but the ICO's guidance on monitoring workers still applies in full. In practice that means:

• A lawful basis and a clear purpose. Most organisations rely on legitimate interests, backed by a legitimate interests assessment. Consent is rarely valid between employer and employee.
• A DPIA. The ICO gives keystroke monitoring as an example of high-risk processing that needs a DPIA, says covert monitoring needs one, and recommends a DPIA for other monitoring even where there is no specific high risk. See employee monitoring DPIA.
• Transparency. Workers must be told about monitoring before it starts, in a policy that matches what the software actually does. See writing an employee monitoring policy.
• Proportionality. Monitor the channels and roles where the risk sits, not everything about everyone. Teramind lets you scope rules by department, group, schedule and application.
• Covert monitoring only in exceptional cases. The ICO says covert monitoring is unlikely to be justified in most circumstances. Where it might be, for example suspected criminal activity or gross misconduct, it should be authorised by senior management, backed by a DPIA, tightly targeted and kept to the shortest time possible. See covert monitoring of employees.

Risk scores, baseline drift and behavioural profiling need particular care. Teramind's own responsible-use notice says its insights, alerts and scores are decision support only and should not be the sole or determinative basis for any decision about a person, and that customers must apply meaningful human judgement. UK data protection law also puts safeguards around decisions based solely on automated processing that have significant effects, so build a human review step into every investigation. The employee monitoring law UK hub explains the wider framework. This is general information; take legal advice for your situation.

Detection works best alongside awareness

Software catches behaviour; people decide whether it happens in the first place. Many insider incidents are accidental, and staff who understand why the rules exist are less likely to trip them. We suggest pairing Teramind with insider threat awareness training, and telling staff plainly what is monitored and why. Knowing the rules exist can make people more careful on its own, which is part of the point.

For the data itself, Teramind's DLP plan adds content inspection and automatic blocking on top of insider threat detection: see Teramind DLP. If you need data loss prevention across email gateways, cloud apps and networks rather than on the endpoint, our sister site covers data loss prevention more broadly.

How Forever Systems helps

We supply Teramind and can help you set it up around the risks you actually have. A typical project covers:

1. Scoping. Which data matters, which roles handle it and which channels it could leave by. We can help you gather the technical inputs your DPIA needs.
2. Plan and hosting. UAM or DLP suit most insider risk programmes, on Teramind Cloud or a private cloud or on-premises deployment depending on where your data must sit. See Teramind deployment options.
3. Agent roll-out. Deployment by GPO, SCCM, Intune or Jamf, with the agent type and monitoring schedule agreed in advance.
4. Rules and dashboards. Starting from Teramind's templates and tuning thresholds, risk levels and actions to your environment so that alerts are useful rather than noisy.
5. Privacy controls. Role-based access, exclusions, blackout of excluded apps and websites, and recording only on rule violation, set up from the start.
6. Ongoing help. We can help with rule tuning, agent updates and renewals.

Contact us to talk through your insider risk and get a quote.