Employee Monitoring Software

Monitor activity and productivity. Manage identity and access. Respond to incidents. All-in-one

Ekran System® is universal employee activity monitoring software that tracks any user action on:

Employee monitoring and control tools

Indexed session video records

Unlike competitors, Ekran uses a session video format that's easy to interpret. Whether it's an authorized, compromised, or backdoor account session and no matter the level of permissions, all sessions are fully recorded and all action context is captured.

Screen video recording

Each user session is recorded with configurable video quality. Recording can be triggered and filtered or include each second from session start to finish.

A YouTube-like player with FF and Live Session View options enables effortless analysis.

In-video episode search

Ekran System enables search by keywords (name of the application opened, command entered, or word typed) both within the current session and across all recorded sessions.

Context-rich recordings

Unlike basic screen monitoring software, Ekran System captures a number of additional employee activity logs used to index session video records: current application name, opened URLs, executed Linux commands, keystrokes, and more.

Metadata facilitates session analysis, PC user activity monitoring, search, alerting, and reporting.

Automatic alerts on suspicious events

Ekran System employee computer monitoring software includes an advanced alert system capable of notifying you in real time about potentially dangerous events in your infrastructure and automatically responding.

Predefined and custom alerts

Ekran System provides libraries of the most important alerts and allows you to build custom alerts using activity parameters such as user and application names, window titles, folder or file names, URLs visited, USB devices connected, keywords typed, and Linux commands and parameters entered. You can specify a risk level for each alert and it will be reflected in reporting and monitoring information.

Automated incident response

For the most critical alerts, you can set up automated incident response actions. These include employee activity monitoring notifications for your security team, allowing them to detect and immediately analyze an issue; customizable warning messages for users who trigger alerts, requiring them to acknowledge their actions; user blocking; and killing of related applications and processes.

USB management

Any comprehensive employee monitoring system should audit USB device usage. Ekran System not only logs and alerts about various USB device connections but can also block them with rules, whitelists, and blacklists.

Productivity monitoring

Ekran System offers advanced productivity monitoring functionality to help you get a comprehensive view of your employees’ performance. With Ekran’s employee productivity tracking software, you can efficiently monitor your staff’s productivity, receive scheduled reports, and set alerts to prevent security incidents.

Productivity report

Use Ekran System’s employee productivity monitoring software to track the active and idle time of employees. This allows you to determine downtime with no user input and get valuable insights into how much time your employees actually spend actively working. You can even configure a schedule to automatically receive productivity reports on a daily, weekly, or monthly basis.

User activity and URL reports

Leverage the power of user activity reports to determine which applications are used by which users or groups of users at a specific time. You can also request deeper insights like the duration of work for each application and try URL reports to compare how much time employees spend on work-related websites compared to social media and other entertainment resources.

Alerts functionality

Ekran System’s software for employee monitoring automatically sends notifications to managers when an employee launches an unwanted application or accesses a restricted website, allowing the manager to review the flagged session. This allows you to efficiently prevent inappropriate use of the internet and eliminate security risks.

Productivity monitoring

Identity and access management

Ekran System’s software to monitor employees provides powerful identity and access management capabilities for critical endpoints. Its toolset allows you to improve user identity verification, organize granular access, deliver and manage temporary credentials, and reinforce purpose-based access principles.

Multi-factor authentication

Build a robust identity confirmation process for your critical endpoints with embedded two-factor authentication solutions based on credentials and confirmation codes from users’ mobile devices.

One-time passwords

Implement one-time passwords to organize emergency access and manage day-to-day access to your most critical endpoints. This functionality allows a security officer to generate a unique temporary password granting server access and send it to a user. Another option is to generate a one-time password at a user’s request via a form during the login procedure. All requests are then logged and manually processed by security experts, who decide whether to approve or deny temporary access.

Privileged access and session management

The PAM module in Ekran System is developed according to NIST standards and helps manage access privileges on jump servers. With this toolset enabled on a jump box as an entry point, you can configure access rules to specific endpoints within a protected perimeter and securely store and manage the credentials of shared privileged accounts.

The most complete set of supported platforms

More on supported platforms

Log any action. Analyze it in context.

Employee monitoring with Ekran System®
These are the tasks most commonly performed with our platform.

Industries with sensitive information use Ekran to comply with regulations

Financial services and insurance

Financial services and insurance



Government and military

Government and military

Public administration

Public administration





Why companies choose Ekran System®

Major user-based risk management controls in one platform

Major user-based risk management controls in one platform

Ekran System is an employee activity monitor that delivers session recording and activity audit as well as identity and access management by means of a single lightweight software agent installed on an endpoint. Ekran can entirely support your insider threat program since it’s built in accordance with NIST 800-53 and most IT security standards.

The broadest OS and network architecture coverage

The broadest OS and network architecture coverage

Ekran System supports all popular operating systems, virtualization solutions, and network architectures. With Ekran System, you don't have to choose between agent-based and jump server schemes: we support any combination.



Designed to work on tens of thousands of endpoints, Ekran System demonstrates exceptional stability and performance. The platform provides several important feature sets to support large-scale projects, such as high availability, multi-tenancy, system resource and health monitoring dashboards, and automated maintenance tasks.

Low total cost of ownership

The unique licensing offered by Ekran System enables cost-effective deployments of any size, from small pilots to enterprise projects. Floating endpoint licensing enables license reassignment in a couple of clicks. For virtual environments, this process is automated.

Get more with Ekran System®

AI-based compromised account detection

AI-based compromised account detection

Cybercriminals are constantly improving their ways of compromising privileged accounts. Powered by artificial intelligence, the Ekran UEBA system can detect a hacker who has penetrated a corporate system using stolen credentials.

Active in your environment in 20 minutes or less

Active in your environment in 20 minutes or less

Ekran System is quick to install and easily integrates with SIEM and ticketing systems. You’ll get a ready-to-use solution right after a coffee break.

Lightweight software agent and highly optimized formats for storing data

Lightweight software agent and highly optimized formats for storing data

The lightweight agent works silently and isn’t noticeable to users or other programs. Collected data is saved in searchable and highly optimized video, audio, and text file formats for compact log storage and easy reporting.

Ekran System® integrations

Ekran System employee tracking software integrates with your infrastructure, including with leading SIEM and ticketing systems.

What Our Clients All Over The World Say



They Chose Ekran System®


What is user activity monitoring?

User activity monitoring software allows you to track user activity within your corporate network, across devices, and throughout your entire IT infrastructure. With user activity tracking tools, you can identify which applications, sites, and data users access and how they interact with them.


With a user activity monitoring solution, you can strengthen your current cybersecurity, protect confidential data from malicious users, and enhance insider risk management.

Why do I need to monitor user activity in my organization?

The goal of implementing a user activity tracking application is to prevent insider threats. Using activity tracking software, you can identify suspicious activity and reduce the risk of a cybersecurity incident. You can also use such software to track employees’ active and idle time to monitor employee performance.


Main reasons to monitor user activities:


  • 1. Secure sensitive information
  • 2. Reduce the risk of insider threats
  • 3. Ensure that users stick to cybersecurity policies
  • 4. Increase employee productivity
  • 5. Comply with applicable cybersecurity standards, laws, and regulations

Is user activity monitoring legal?

Yes. Digital user monitoring is legal, but it’s regulated by legislation.


To know how to monitor user activity legally, you should check with applicable laws within your jurisdiction. Typically, legislation requires businesses to inform users of monitoring and receive their consent.


If your organization operates in the US, you should pay attention to both federal and state laws, as state laws can have their own requirements. For example, businesses that operate in Connecticut and Delaware don’t have to notify employees about email or internet monitoring. Meanwhile, employers in Colorado and Tennessee must create written email monitoring policies.

How does Ekran System monitor user activity?

Ekran System is a powerful insider threat management platform that ensures comprehensive user activity monitoring.

In particular, Ekran System monitors user activities in real time and makes video and audio recordings of user sessions so you can watch them later if needed. All records are searchable. Thus, you can find out whether a user has accessed certain data, launched specific applications, or visited particular websites during working hours.


Also, Ekran System continues monitoring user activity even if the internet connection goes down.

Does Ekran System interrupt employees’ work?

No. Ekran System does not influence the user experience. It monitors user activity smoothly without disturbing users.

However, Ekran may interrupt a user’s work if the user acts suspiciously. According to customizable rules, users can receive notifications explaining that a particular action violates cybersecurity policies. Also, your security admins can automatically or manually block suspicious sessions, users, and actions as needed.

How does Ekran System store collected data?

When monitoring user activity on an organization’s network, Ekran System gathers the necessary data and stores it securely using military-grade encryption. Ekran System doesn’t store passwords entered by monitored users.

What do I get from deploying Ekran System?

Ekran System offers more than just monitoring. Using this platform, you can:


  • 1. Know who accesses your sensitive data and how they handle it by arranging robust real-time user monitoring
  • 2. Prevent data leaks and breaches caused by insiders by detecting suspicious activity and instantly responding to it
  • 3. Enhance your cybersecurity by automatically sending notifications when users violate cybersecurity policies
  • 4. Evaluate employee efficiency by analyzing productivity reports
  • 5. Ensure compliance with various standards, laws, and regulations including GDPR, NIST, FISMA, HIPAA, and SWIFT


As a robust insider threat management platform, Ekran System can easily be adjusted to the specific needs of your organization.


For example, you can receive automatic custom reports on a convenient schedule. Also, in case an incident occurs, you can quickly export a full monitored session or a fragment of a session into an independent file.

How can I deploy Ekran System?

Ekran System is on-premise software that supports various deployment options. You can install Ekran System Client on each endpoint or install just one Ekran System Terminal Server Client on a jump server to ensure user activity monitoring of all sessions that come through your server.


Installation is easy and takes less than an hour. If you have any questions or doubts during the process, our 24/7 customer support team will be there for you.

More FAQ

Monitor User Activity with Ekran System®

Is employee computer monitoring software a good idea?

Employees access sensitive data. Legally. Every Day.

That's what they're supposed to do, right? This is one of the major reasons why it's complicated to detect and investigate security incidents related to high-risk inside actors.

The most devastating and most covert attacks on the modern cybersecurity landscape originate from insiders who have access, know the ins and outs of the corporate infrastructure, and perform thousands of operations with data and configurations every day.

Share of insider-driven data breaches in the last 12 months * *According to the 2019 Data Breach Investigations Report from Verizon

** 2020 Cost of Insider Threats: Global
Organizations report by the Ponemon Institute

The cost of an employee data breach is rising each year

Total average cost of insider-related incidents over a 12-months period = $11.45 million.

Annualized cost for:
  • Negligence = $4.58 million
  • Criminal insider = $2.79 million
  • Credential theft = $4.08 million

Employee monitoring is an essential part of a corporate security strategy.


36% of all data breaches in the financial sector are driven by an internal actor.*


59% of all data breaches in healthcare are driven by an internal actor.*


30% of all data breaches in public administration are driven by an internal actor.*

* According to the Verizon 2019 Data Breach Investigation Report


Does Ekran System provide SaaS or on-premise deployment?

The out-of-the-box version of Ekran System supports on-premise and SaaS deployment.

Does Ekran System work on bastion hosts?

We’re a universal employee monitoring solution that supports activity tracking on bastion hosts, infrastructure and terminal servers, and desktops.

What are your storage requirements and performance stats?

Ekran System applies highly optimized formats to store session recordings and metadata. The platform is also optimized in terms of bandwidth usage. You can see actual performance numbers and basic hardware requirements for some typical deployments in our technical documentation.

Do you support virtual desktop monitoring?

Ekran System supports virtual desktop employee activity monitoring, such as Hyper-V, VMware, and Citrix Session.

Can I hide the Ekran System client from users?

Ekran System isn’t spyware, so it doesn’t support hiding. Although Ekran System agents are visible, we deliver the best client protection mechanisms on the market, making our software unstoppable even for privileged users.

Can I capture keystrokes? And what about passwords?

Ekran System captures all keystrokes and even clipboard content. They’re hidden in the session recordings so security specialists can’t see sensitive data such as passwords in plain text. At the same time, all keystroke logs are searchable.

Our Linux clients capture entered exec* and sudo commands with all their parameters as well as content of all started scripts.

More FAQ