ObserveIT Insider Threat Management

Short Summary

ObserveIT is a privately held software vendor headquartered in Boston, founded in 2006 by Israeli entrepreneurs and originally focused on monitoring remote privileged users. Over time, it expanded monitoring to other sensitive users, including third-party vendors, contractors, administrators, and business users. After a 2014 investment round it established its US headquarters, and it now serves more than 1,700 customers across 80+ countries, mainly in financial services, healthcare, telecommunications, manufacturing, and retail.

The product centers on Visual Endpoint Recording via lightweight endpoint agents that capture granular session context—far beyond video—such as applications and processes, file/folder access, browser URLs, keystrokes, print jobs, USB activity, and even SQL queries for database auditing. Data is collected centrally on an application server (with MS SQL Server storage), where analytics, alerting, and reporting are delivered through a web dashboard. While endpoint impact is low, privacy risks are addressed through flexible capture policies (including event-triggered recording), anonymization, access controls, a “session privacy lock,” Active Directory integration, and auditing of administrative actions.

In contrast to machine-learning anomaly detection common in User Behavior Analytics, ObserveIT emphasizes rule-based detection derived from academic research into insider threat indicators, maintained with Carnegie Mellon University. Hundreds of rules across 25 risk categories ship with the platform, enabling targeted alerts and automated mitigations like warnings, command blocking, USB blocking, SIEM forwarding, session recording, or locking a user out. Added capabilities include File Diary for data-centric tracking of sensitive file movement and robust full-text search for investigations, with basic collaboration workflows and ticketing integration. Key constraints include the need for widespread agent deployment, limited detection of unknown (“zero-day”) behaviors, lack of file hash capture (planned), and no highly available/distributed application server deployments.

Interesting Facts

• ObserveIT was founded in 2006 by Israeli entrepreneurs and is privately held.
• The company is based in Boston, Massachusetts, and established its US headquarters after a 2014 investment round.
• ObserveIT serves more than 1,700 customers in over 80 countries.
• Primary customer industries include financial services, healthcare, telecommunications, manufacturing, and retail.
• ObserveIT 7.5 was the latest version at the time of the review.
• Endpoint agents support Windows, macOS, Linux, other Unix variants, and popular virtualization platforms.
• The application server requires an external Microsoft SQL Server database for storage.
• The product ships with several hundred insider threat rules grouped into 25 risk categories.
• The dashboard includes a global “session privacy lock” and configurable data anonymization.
• File Diary does not yet support file hash capture, and hash capturing is planned for a future release.

Notable Quotes

• “The very notion of a privileged user has changed as well: it is no longer the system administrators that can pose the biggest risk to your company.”
• “Knowing what each user is doing at any moment is becoming the most critical part of a sensible cybersecurity strategy.”
• “Just detecting a statistical anomaly is not enough to understand the exact nature of the incident.”
• “ObserveIT offers an alternative approach towards insider threat detection: instead of anomaly detection, the company focuses on academic research of commonly seen indicators of insider threats.”
• “In a sense, ObserveIT Insider Threat Management platform combines the functionality of a traditional user behavior analytics solution and a data loss prevention product.”
• “This agent-based approach allows capturing not just a video recording of a session, but a detailed log of various activities.”
• “More important are the potential privacy implications of such invasive monitoring.”
• “A rule-based solution, on the other hand, will only raise an alert when a known malicious activity is detected, and an appropriate response action can be performed automatically.”
• “The rich metadata that’s collected by the system allows security teams to reconstruct the most minute details of every user session.”
• “ObserveIT Insider Threat Management is a platform that combines the functionality of traditional User Behavior Analytics (UBA) and Data Loss Prevention (DLP) products in a lightweight and streamlined solution.”