Each user's behaviour is scored against policy and the outliers flagged — unusual access, sudden spikes in data movement, atypical working hours.
Schedule a Demo
Insider threats are hard to detect precisely because the actor has legitimate credentials — the malicious pattern is buried inside otherwise ordinary activity.
Perimeter firewalls catch outsiders. They do nothing about the employee who copies a customer database to a USB drive at 11 p.m. the week before resigning, or the contractor whose access rights were never revoked. Insider threats are hard to detect precisely because the actor has legitimate credentials — the malicious pattern is buried inside otherwise ordinary activity.
Security teams need a system that turns everyday events into a running score for every individual, then surfaces the ones that cross a threshold automatically. Not a wall. A lens.
Insider risk sits at the intersection of IT security and people management. IT-security professionals need hard evidence — timestamped events, a risk score, a behavioral timeline — to open an investigation and justify escalation. HR and line managers need context: is this person showing early warning signs? Is there a pattern across their communications, productivity, and data transfers that warrants a closer look?
Anexet bridges both audiences. The Risk Analysis module surfaces numeric risk scores and incident alerts to the security console. The employee dossier consolidates incidents, productivity signals, and active device information into a single dashboard that a manager can read without deep technical knowledge.
A configurable User Profile dashboard closes the gap between flagging a risky user and doing something about it. For any monitored employee it brings together incidents and the latest events, productivity metrics, summary analytics, active processes, and connected devices in one place, refreshing in real time so a reviewer can jump straight to the event that raised the score. Audio and video monitoring for that person can be started directly from the same screen, and reports on the selected user are generated from there too — no switching modules mid-investigation.
AI-assisted post-processing helps the security team keep up with volume: it can auto-assign a status to routine incidents and filter out false positives, so alerts land on events that are genuinely worth a look instead of burying the team in noise.
Every triggered Security Policies rule — content-based or statistical threshold — feeds a per-user, per-category risk score, so the number always traces back to a specific, reviewable event.
A visual map of every employee's connections to colleagues, external contacts, cloud storage, USB devices, and printers — derived from intercepted events, not org-chart data.
All risk scores, incident data, and employee dossiers are stored and processed inside your own infrastructure. The vendor has zero access.
Risk Analysis turns triggered Security Policies incidents into a per-user risk score and category, the relationship graph shows who each employee communicates with and through which channel, and the User Profile dashboard brings incidents, productivity data, active processes, and device information together on one real-time screen — with monitoring and reporting launched from the same place. The underlying activity data is collected by the endpoint agent — silently, in the background, across Windows, Linux, and macOS.
Every incident raised by a Security Policies rule — content-based or statistical threshold — adds to the affected user's risk score, broken down by nine preset categories (data leak, employee disloyalty, unproductive activity, and more) plus custom categories you define.
A dedicated rule type flags frequency-based outliers rather than single events — for example, more than a set number of messages in one messenger within an hour, evaluated per user or across the network with configurable thresholds and time windows.
Specific behavioral signatures — mass-exporting documents, repeated policy violations, elevated DLP incident counts — raise the risk profile automatically as the underlying rules fire.
The Notification Manager sends an instant alert (email or Telegram) the moment a user's risk crosses a configured threshold, or a daily digest across all monitored users, so investigations start before data leaves the organization.
A graph view plots each employee's connections to colleagues, external contacts, cloud storage, network shares, FTP servers, USB devices, and printers — derived from intercepted events.
The graph can be narrowed to show only channels where a policy violation or blocking event occurred, immediately highlighting the riskiest communication paths.
When two or more users show an unusual connection pattern — a sudden increase in communications between an employee under review and an external address — the graph makes it visible.
A single, customizable screen shows recent incidents, DLP policy triggers, productivity metrics, summary analytics, active processes, and connected devices for any monitored user — refreshing in real time, with quick jump-to-event navigation straight from the timeline.
Predefined and custom tags — 'preparing to resign,' 'under review,' 'elevated access' — are visible across all modules so context follows the user regardless of which screen is open.
Audio and video monitoring sessions can be started directly from the employee's profile page, and reports covering the selected user are generated from the same screen — no navigating to a separate module.
Our team confirms the exact capability set for your environment during the demo.
A lightweight agent, deployed silently across endpoints, records application and browser usage, file operations, network activity, USB connections, DLP-channel events (mail, messengers, cloud, print), keystrokes, and screenshots. All data flows to your on-premise server — no data leaves the corporate perimeter.
Anexet is deployed entirely on-premise. The vendor has no access to any data collected, processed, or stored by Anexet — not risk scores, not incident records, not employee dossiers. All processing happens inside your infrastructure, under your control.
Four steps from endpoint data collection to a controlled, investigation-ready risk record.
A lightweight agent on the workstation collects application usage, file operations, network activity, USB connections, DLP-channel events, keystrokes, and screenshots — silently, without impacting user performance.
1
All intercepted events are indexed and stored on the organization's own infrastructure — vendor has zero access; retention periods are configurable.
2
Security Policies rules — content-based and statistical threshold rules — evaluate the event stream continuously. Each triggered incident adds to the affected user's risk score and risk category inside Risk Analysis.
3
When a risk threshold is crossed, the security officer opens the employee's User Profile dashboard to review the full context in real time — risk score, event timeline, relationship graph, productivity metrics, recent DLP incidents — and can jump straight to the flagged event, launch audio/video monitoring, or generate a report on that user without leaving the screen.
4
A lightweight agent on the workstation collects application usage, file operations, network activity, USB connections, DLP-channel events, keystrokes, and screenshots — silently, without impacting user performance.
1
All intercepted events are indexed and stored on the organization's own infrastructure — vendor has zero access; retention periods are configurable.
2
Security Policies rules — content-based and statistical threshold rules — evaluate the event stream continuously. Each triggered incident adds to the affected user's risk score and risk category inside Risk Analysis.
3
When a risk threshold is crossed, the security officer opens the employee's User Profile dashboard to review the full context in real time — risk score, event timeline, relationship graph, productivity metrics, recent DLP incidents — and can jump straight to the flagged event, launch audio/video monitoring, or generate a report on that user without leaving the screen.
4
Common questions about how Anexet detects and investigates insider threats.
Insider threat detection software monitors authorized users — employees, contractors, and administrators — to identify behavior that may signal malicious intent, negligence, or account compromise. It differs from perimeter security by focusing on what happens after someone is already inside the network: unusual data access, policy violations, or behavioral shifts that precede a leak or sabotage event.
Yes. Anexet is deployed on-premise; the vendor has no access to your data. All intercepted events, risk scores, and employee dossiers are stored and processed inside your own infrastructure. There is no cloud component that sends employee data to Scinero or any third party.
No. Scinero Software Limited has no access to any data collected, processed, or stored by Anexet. The system operates entirely within your corporate perimeter. This is a deliberate architectural choice, not a policy statement — the product has no telemetry channel back to the vendor.
Risk Analysis aggregates incidents triggered by Security Policies rules — content-based rules and statistical threshold rules (for example, more than a set number of messages sent in an hour) — into a numeric score per user and risk category. It is rule-driven, not a black-box machine-learning model: every point on the score traces back to a specific, reviewable event, and administrators configure the thresholds. The exact scoring configuration for your environment is confirmed during the demo.
Insider threat detection is a legitimate security practice when deployed under a clear policy that employees have been informed about. Security teams typically use these tools to investigate specific concerns rather than to conduct blanket surveillance. Because Anexet is on-premise and controlled entirely by the organization, the decision about what is monitored, who can see it, and how data is retained rests with the employer — not the vendor. Organizations should document their monitoring policy, obtain required consents under applicable law (GDPR, local labor law), and restrict console access to authorized personnel using the built-in RBAC controls.
When a user's risk score crosses a configured threshold, the Notification Manager sends an instant alert to the responsible security officer, or a daily digest if immediate notification is not enabled. The officer can then open the employee's User Profile dashboard to review the full context — the triggering events, the risk timeline, recent DLP incidents, productivity metrics, and the relationship graph — and decide whether to escalate, launch closer audio/video monitoring, or close the alert. All actions are logged.
The User Profile dashboard is a configurable, per-employee screen that brings together everything a reviewer needs during an investigation: recent incidents and events, productivity metrics, summary analytics, active processes, and connected devices, all refreshing in real time. It supports quick jump-to-event navigation, and audio/video monitoring plus reports on that user can be started directly from the same screen.
Yes. AI-assisted post-processing can automatically assign a status to routine incidents and filter out likely false positives, so notifications concentrate on events that warrant a closer look. Administrators can add extra context and instructions to tune accuracy for their environment, and both cloud and on-premise models are supported — organizations that need to keep data inside their perimeter can run the AI layer entirely on-premise.
Tell us about your security posture and workforce size — we'll map the right plan and arrange a demo or a free trial of Anexet Ultimate.
