A name on the screen changes what people do with it.
Visible watermarks put a name and a time on protected screens. Screenshots of labelled documents are blocked, a phone raised at the display is noticed, and a risk score per person shows your team where to look first.
From the screen to the case file.
Insider Risk discourages capture at the moment it happens, scores the behaviour around it, and gives investigators one place to work. Every part runs on the same agent and console.
Screen watermarks
A light, tiled mark with the user's name, the machine and the time over the applications and web pages you choose.
Screen capture blocking
PrintScreen, Win+Shift+S, Snipping Tool, screen recordings and third-party capture tools, blocked always or only while sensitive work is in front.
Camera Guard
The webcam notices a phone raised at the screen and can notify or lock, while the video stays on the device.
Risk scoring
A score from 0 to 100 per person and per machine, measured against the peer baseline, that can tighten policy on its own.
Incidents
Related events gathered into one incident, with linked evidence, owners, SLAs, saved views and resolution trends.
Cases and investigations
Incidents, people, machines and files grouped into a case, with a merged timeline and a graph of what went where.
Signals from DLP
Clipboard, file, email, web and network detections feed the score without extra setup.
Signals from Device Control
Blocked USB drives and policy overrides count toward the person who caused them.
A reminder on every protected screen.
People think twice before photographing a screen that carries their own name and the time. Tracemark paints that reminder over the applications and sites you choose, on Windows desktops and in the browser.
- Your own wording. Build the mark from the user name, full name, machine, IP address, date and time.
- Subtle by default. A mid-grey tone reads on white documents and dark terminals alike, with opacity from 2 to 50 percent.
- Same coverage on every monitor. The mark scales with screen resolution, so a laptop and a large display look alike.
- Only where it matters. Choose applications and web domains, with exclusions.
- Printed pages too. Add a watermark line to print jobs from protected machines.
Screenshots stop at sensitive work.
Block screen capture everywhere, or only while a chosen application or a labelled Office document is the window in front. Until then, screenshots work as usual. When one is refused, the person is told why.
- Built-in tools. PrintScreen, Win+Shift+S, Snipping Tool and images copied to the clipboard.
- Recordings. A Snipping Tool recording is stopped within a second and the saved file removed.
- Third-party tools. OBS, Bandicam, ShareX, Snagit and similar capture tools.
- By label. Trigger on Restricted, Confidential or Internal documents in Word, Excel and PowerPoint.
- Exceptions. Exempt users and computers, whose screenshots are still reported.
A photo of a screen bypasses every screenshot control.
Camera Guard uses the webcam and an on-device model to notice a phone raised toward the display.
The video stays on the device
Detection runs locally and only the event is reported. An evidence frame is kept only if you turn that on, and consent is required.
Seen in most recent frames
A phone has to appear across most of the recent frames, so a single flicker does not fire an alert.
Ignore the phone on the desk
Count only a raised phone, and leave one lying flat beside the keyboard alone.
Notify or lock
Record the attempt and tell the person, or lock the screen straight away.
Three sensitivity levels
From fewest false alarms to most sensitive, chosen for your environment.
Light on the machine
Set how many frames per second are checked, so older laptops keep working smoothly.
See who is drifting from the norm.
Scored events from recent weeks add up to a score from 0 to 100. The score is relative: it measures how far a person or machine sits above their peers, so a busy team is not flagged simply for being busy.
- Per person. Each event counts against the user the agent recorded at the time, with all their devices combined.
- Anomalies. A score two standard deviations above the peer mean stands out.
- Rising behaviour. A flag marks people whose last seven days run well above their own recent rate.
- Explainable. Open any score to see the signals and events behind it, then raise an incident in one click.
- Risk-adaptive policy. At medium and high risk, endpoint DLP moves one step stricter for that person's machines.
One queue, then one case file.
Repeated events from the same machine and subject gather into one incident, so analysts work a short queue with the context in each item. When something needs a real investigation, it becomes a case.
- Triage fast. Search, filters, one-click presets and saved views.
- Ownership. Auto-assignment to a pool and an SLA per severity.
- Trends. Time to resolve, SLA compliance and the false positive rate.
- Cases. Incidents, people, machines, files, domains, IP addresses and hashes in one place, with a record nobody can rewrite.
- Evidence packs. Export an incident or a whole case as one file, recorded in the audit log.
From a signal to a closed case.
How risky behaviour moves through Insider Risk, from the first event on a device to the file you hand to HR or legal.
Signal
A blocked copy, a screenshot attempt, a print or a USB override is recorded.
Score
The event adds to that person's score, compared with their peers.
Incident
Related events gather into one incident, with an owner and an SLA.
Case
An investigator groups incidents, people and files into a case.
Evidence pack
The timeline, events and notes export as one file.
What is included.
Insider Risk is a set of modules on one agent and one console. Turn on the ones you need.
A visible mark that reminds everyone looking at the screen who is signed in and when. It is there to discourage capture in the first place.
- User name, full name, machine, IP address, date and time
- Chosen applications and web domains, with exclusions
- Windows desktops and the browser
- Opacity, size and colour per policy
- Scales to each screen's resolution
- Optional watermark line on printed pages
Block screenshots everywhere, or only while a sensitive application or a labelled Office document is in front. The person sees why.
- PrintScreen, Win+Shift+S, Snipping Tool and clipboard images
- Snipping Tool recordings stopped and the saved file removed
- OBS, Bandicam, ShareX, Snagit and similar tools
- Trigger by application or by label
- Exempt users and computers, still reported
- Optional upload of the captured image as evidence
The endpoint webcam watches for a phone raised at the screen, the one channel screenshot controls cannot see.
- On-device detection; the webcam image stays on the machine
- Three sensitivity levels
- A frame rate you set
- Ignore a phone lying on the desk
- Notify only, or lock the screen
- Optional evidence frame, with consent
Ranks people and machines by how far their recent behaviour sits above their peers, and can tighten policy for the ones that stand out.
- Score from 0 to 100 with low, medium and high levels
- Peer baseline; an anomaly is two standard deviations above it
- Rising flag for behaviour that is just starting
- Signal weights you can tune
- Risk-adaptive DLP: monitor, warn, block
- Filter, search and CSV export
Repeated events from the same machine and subject gather into one incident, with the evidence linked.
- Search, filters, presets and saved views
- Bulk assign and resolve, with a written resolution
- SLA per severity and auto-assignment to a pool
- Trends for time to resolve, SLA compliance and false positives
- Evidence pack and CSV export, both audited
- Captured content masked for roles that may not read it
A case gathers the incidents, the people and machines it is about, a merged timeline and a record that cannot be edited.
- Users, machines, files, domains, IP addresses and hashes
- An incident can belong to more than one case
- Owner, severity, status and a reason on closing
- Graph of people, machines, devices, files and destinations, two steps out
- Opening the graph is recorded in the audit log
- Evidence pack export
One list of the open gaps that matter most, counted from what the product already records. Each item opens the page where it is fixed.
- Ordered by severity, from critical to low
- Checks with no data shown as not measured, never as fine
- Accept a risk with a reason until a set date
- Every acceptance recorded with who and why
What feeds the risk score.
Each signal has a weight you can change. The score counts how far a person or machine exceeds the peer baseline, so zero means at or below it.
| Signal | What counts | Comes from |
|---|---|---|
| Tamper | Attempts to stop or interfere with the agent | Endpoint agent |
| Screen capture | Screenshots and third-party capture tools | Endpoint agent |
| Remote sessions | Remote access tools in use | Endpoint agent |
| Printing | Print jobs | Endpoint agent |
| Clipboard, file and email DLP | Policy matches on copy, save, USB and send | Agent and mail add-in |
| Web and AI | Uploads to websites, AI tool use and blocked prompts | Browser extension and agent |
| Network DLP | Outbound transfers blocked on the device | Endpoint agent |
| USB | Blocked removable drives and policy overrides | Device Control |
Questions.
Does Camera Guard send webcam video anywhere?
No. Detection runs on the device and the webcam image stays there. Only the event is reported. If you turn on evidence frames, a single frame is kept with the event, and that setting requires consent.
Can we block screenshots only for sensitive work?
Yes. Choose applications by process name, or labels such as Restricted and Confidential on Word, Excel and PowerPoint documents. Screenshots work normally until one of them is the window in front.
Will the watermark get in the way?
It is designed to be subtle. The default mid-grey reads on light and dark screens, opacity goes as low as 2 percent, and you choose which applications and sites carry it.
How is a person's risk score worked out?
Scored events from recent weeks are added up with the weights you set and compared with the peer baseline. Each event counts against the user recorded when it happened. Events that recorded no user are shown under whoever is signed in and marked as such.
Can a high score change what is enforced?
Yes, if you turn on risk-adaptive policy. At medium and high risk, endpoint DLP on that person's machines moves one step stricter, from monitor to warn to block, and the justification override can be removed at high risk.
Works well with
See it on your own screens.
We set up watermarks, capture blocking and risk scoring on a test machine of your choice, and walk through a case together.