TI-2026-061M — The Threat Is You

Classification: MEDIUM · Workforce Surveillance · "Monitoring" / Bossware / Insider Threat Confidence: HIGH on the "insider threat" framing (in-corpus) and the bossware market; MEDIUM on the specific product/employer claims, from public reporting. TLP:WHITE — public products, public reporting, corpus research. Series: The Fake Umbrella — Part M. M is for "Monitoring." Point every tool in this series inward, at your own workforce, and rename it "productivity" and "protection." The suspect is the person at the next desk — or you. Facts are facts. They are good for some and bad for others. You decide.

The seed: a research field whose subject is the employee

Most letters in this series start with a leak or a case. This one starts with a category — a legitimate-sounding academic and industry discipline sitting in our own corpus: "Insider Threat Behavioral Analysis." Read the phrase slowly, because the whole letter is folded inside it. The "insider" is not a hacker in Shanghai or a botnet in a datacenter. The insider is the employee — the person you hired, who badges in every morning, whose behaviour is now something to be analysed, scored, and predicted as a threat.

That reframing is the hinge of Part M. Every other kind of surveillance in this series had to justify pointing a tool at a stranger. "Monitoring" does something subtler and more total: it turns the tool inward, at your own people, and renames the act. It is no longer spying on staff — a thing with a bad name and, in many places, laws against it. It is now "security" (insider-threat protection) and "productivity" (performance management). Same cameras, same keyloggers, same scores — pointed at the workforce, and blessed by two of the most unarguable words in business.

What "monitoring" actually installs

Strip the HR language and look at the software. The "employee monitoring" and "productivity" market — Teramind, Veriato, ActivTrak, Hubstaff, Time Doctor and a crowd of peers, adoption of which exploded when remote work sent everyone home — routinely offers, as features:

• Keystroke logging — every key, in every app.
• Periodic screenshots — your screen, captured on a timer, for review.
• Webcam capture — your face, at your desk, sampled.
• Active/idle tracking — mouse and keyboard motion turned into an "activity" percentage.
• App and URL logging — everything you open, ranked "productive" or "unproductive."
• A per-worker "productivity score," and often an "insider risk score," computed by a model.

And at the industrial edge, the euphemism drops the pretence of gentleness: Amazon tracks warehouse "time off task" (TOT) to the second, and its delivery vans carry AI driver-facing cameras (Netradyne "Driveri") that watch and score drivers continuously — a system reported over and over to drive fear, injury and churn. This is the same surveillance stack the rest of the umbrella sells to governments, installed by the boss, on the worker, and called efficiency.

The god-mode agent you were told was protection

Here is the part even security-literate people miss. The single most powerful surveillance sensor in a modern company is not the bossware — it is the endpoint security agent everyone agrees is good: the EDR/MSSP tool (CrowdStrike, SentinelOne and peers) installed to stop malware. By design, to do its job, that agent has total visibility of the machine: every process launched, every file touched, every network connection, every command typed, kernel-level hooks that can see essentially anything.

It is sold — honestly, and correctly — as protection. But the exact same telemetry that catches a ransomware beacon is a god-mode behavioural record of the employee: what they run, when they work, what they open, how long they idle. "We only use it for security" is a promise the watched worker cannot verify — the agent is silent, the data flows to a console they never see, and the line between "hunting a threat" and "watching a person" is a policy choice made by someone above them. The protective tool and the surveillance tool are not cousins. They are the same agent, and which one it is on any given day is invisible from the desk.

The seven questions

Who is this? The workplace-surveillance stack — bossware vendors, "insider threat" security, industrial monitoring (Amazon TOT/cameras), and the EDR agents that double as behavioural sensors.

Why did it attack? No external attack — an inward turn. The tools are pointed at the organisation's own workforce and renamed protection and productivity.

Who does it claim to be? Security (stopping data theft and insider risk) and management (measuring and improving productivity). Both unarguable; both cover.

Whom is it related to? The device fingerprinters (061F — an unseen, unclearable behavioural record) and the threat-intel scorers (061H — a person turned into a risk number by a model they cannot contest), now aimed at employees.

Where is the money? Vendor licences to employers, and the productivity/loss-prevention gains employers extract from a workforce watched into compliance. The worker generates the data and bears the cost; the employer is the customer.

What is the official anchor? The employment contract and an acceptable-use policy — "consent" obtained under the one power asymmetry no one can walk away from without losing their livelihood.

What if it is not who it claims? It is who it claims — security and productivity software. The finding is that continuous, covert, coerced, uncontestable surveillance of workers is those things now, and "insider threat" is how a presumption of guilt got installed as a default.

What if…

• What if insider threats are real? They are — data theft and sabotage by employees happen, and targeted, disclosed, proportionate controls are legitimate. The target is not that; it is the blanket version, where everyone is watched continuously as a suspect because a few might offend. Presuming the whole workforce guilty to catch the rare bad actor is the harm, not the mitigation.
• What if productivity measurement is just management? Measuring outcomes is management. Measuring keystrokes, idle seconds and webcam presence is measuring visible motion, which rewards performing busyness over doing the work — and, at Amazon scale, injures people chasing a metric. Activity is not value; conflating them is the coercion.
• What if employees consented? Under employment, "consent" you cannot refuse without losing the job is not consent, it is compliance — and the surveillance is invisible and unappealable besides. A choice between being watched and being unemployed is not a choice the word "consent" was built to cover.

Steelman: the strongest defence — and why it fails

Built at full strength:

"Employers have a legitimate right and duty to secure their systems, protect data, prevent insider theft, and ensure they are paying for work actually done. Monitoring on company equipment, disclosed in policy and agreed to at hire, is lawful and normal. EDR is essential security. Remote work made some visibility necessary. This is stewardship, not spying."

Where it breaks:

• "Disclosed and agreed at hire" is coerced consent, again. A term you must accept to be employed, enforced by a silent agent you cannot audit, is not the free, informed, revocable consent the defence implies. It is the 061L problem with the power turned all the way up.
• "Securing systems" and "watching people" are conflated on purpose. Real DLP and EDR can be scoped, logged, and oversight-bound; blanket keystroke/screenshot/webcam capture and productivity scoring are not "security," they are workforce surveillance wearing security's coat. The steelman defends the narrow to license the broad.
• "Ensuring work is done" describes outcome management and delivers activity surveillance. The defensible goal (paying for real output) does not require — and is not served by — a second-by-second behavioural feed; Amazon's TOT shows where the activity metric leads.
• The one true thing: targeted, proportionate, transparent security and honest outcome-based management are legitimate, and good employers practise them — this dossier defends that. Their honesty is in the scope, the disclosure, and the appeal. The moment monitoring becomes blanket, covert, coerced, and uncontestable — the moment the default posture toward your own staff is suspect — it has changed from stewardship into surveillance, and kept the friendly name.

Verdict: scoped, disclosed, proportionate security and outcome management are legitimate. "Monitoring" as practiced — continuous keystroke/screen/webcam capture, productivity and "insider risk" scoring, god-mode EDR doubling as behavioural surveillance, all coerced and uncontestable — is MEDIUM, and corrosive in a way stranger-surveillance is not, because it is aimed at the people who trusted you with their working lives. "Monitoring" is not a mitigation. It is the word that turned the workforce into the threat model. Confidence: HIGH on the framing and market; MEDIUM on specific claims.

Read between the lines

The tell is the pronoun that goes missing. "Insider threat" is built to make you picture a rogue — the disgruntled admin, the leaker — so that you nod along to the defence. But the surveillance it justifies does not, and cannot, watch only the rogue; it watches everyone, because you cannot tell who the rogue is without treating all of them as candidates. So the true subject of "insider threat monitoring" is not the one bad insider. It is you, the ordinary employee, reclassified from asset to risk the day the software was installed — and the genius of the phrase is that it gets the honest majority to consent to their own suspicion by dangling the guilty minority. Every worker under an "insider threat" program is, by the program's own logic, a suspect who has not offended yet. That is the quiet, corrosive thing the calm word installs: a workplace where trust is not the default, and the camera is.

The human layer

A woman works from her kitchen table because that is where work happens now. She does her job well. But a piece of software her employer requires takes a screenshot of her screen every few minutes, samples her webcam, counts the seconds her mouse is still, and rolls it all into a number a manager she rarely speaks to can see and she cannot. So she stops getting up to think. She jiggles the mouse during a phone call so the "active" bar stays green. She feels watched in her own home, at her own table, by her own employer, for the crime of being an employee — and none of it is illegal, and all of it is called "productivity." She was not accused of anything. She did not do anything. She simply became, on the day the agent was installed, a thing to be watched rather than a person to be trusted, and no one ever quite said so, because the word on the invoice was protection. Multiply her by a workforce and you have the quiet fact of Part M: the surveillance this series documents pointed at strangers and dictators has been turned, gently and permanently, on the ordinary people at the next desk — and they were told it was for their own good.

Defense — scope it, disclose it, or don't call it protection

(1) Demand scope and disclosure. Legitimate security is targeted, logged, and oversight-bound; if a tool captures keystrokes, screens or webcams of everyone all the time, it is surveillance, and it should be named, justified, and minimised — not smuggled in under "EDR" or "productivity." (2) Separate security telemetry from performance management. The god-mode agent that stops malware must not quietly become the manager's productivity feed; that boundary is a policy choice, and its absence is the abuse. (3) Give workers visibility and appeal. A person scored by a model — "productivity," "insider risk" — must be able to see and contest the score; unseen, unappealable scoring is the 061H harm in the workplace. (4) Treat "insider threat" as a claim about scope, not a blank cheque. Real insider risk justifies specific, proportionate controls; it does not justify treating an entire workforce as suspects, and the word should not be allowed to do that work unchallenged.

Investigation metadata

Next — TI-2026-061N: N is for "NSO" — the mercenary-spyware industry (NSO/Pegasus, Paragon) that sells a phone-into-a-microphone to states, including the "democracy-friendly" rebrands, and the journalists and dissidents it landed on.

Take every tool in this series, turn it around, point it at your own staff, and christen it "productivity" and "protection." The disgruntled leaker the word conjures is not who gets watched; everyone does, because you can't find the one without suspecting the many. The most total surveillance most people will ever live under is not a government's — it is their employer's, installed on the laptop they were handed on their first day, and described, on the purchase order, as being for their own good. Facts are facts. They are good for some and bad for others. You decide.