Cyberhaven Insider Risk Management helps security teams detect insider threats and protect important data by combining data awareness with behavioral signals. It monitors activity across cloud services, devices, messaging, email, and apps, and can block exfiltration through cloud, email, websites, removable storage, and Apple AirDrop. Risk scores factor in data sensitivity and can include organization-defined user risk groups. Event records are retained indefinitely, allowing activity separated by weeks or months to be connected. For investigations, the product can remotely capture user actions related to data and store forensic events in Cyberhaven’s cloud. Optional screenshots and highlighted policy matches can be kept in the customer’s cloud. The product includes dashboards, customizable reporting, role-based permissions, watchlists, and incident response features. It supports directory services, SIEM and SOAR platforms, cloud applications, and customer cloud repositories; it also integrates with SIEM tools such as Splunk and exposes incidents through an API. It supports API, browser extension, Linux, macOS, web, and Windows. Pricing is on request.
Who it is for
It suits security teams investigating insider risk and responding to data-related incidents. The product is aimed at organizations that need user risk scoring, exfiltration controls, and investigation workflows.
What is good
- Blocks exfiltration across cloud, email, websites, and removable storage.
- Correlates events separated by weeks or months.
- Risk scores can include data sensitivity and defined user groups.
- Offers dashboards, customizable reports, and configurable roles.
What to know first
- Pricing is available only on request.
- Support engineers are available weekdays, 9:00 AM–5:00 PM ET.
Verdict
Cyberhaven combines behavior monitoring, risk scoring, and controls for preventing data exfiltration. Its investigation features include retained event records and optional evidence storage in the customer’s cloud.
Compared on insider risk management software
- User risk scoring
- Yes
- Insider-risk workflows
- Yes
- Data exfiltration detection
- Yes
