Behavox Falcon vs Bottomline Internal Threat Management

Behavox Falcon is a human risk intelligence product designed to identify signals that may precede insider incidents. It analyzes 150+ communication data types against 18 risk policies: 17 AI-powered and one rule-based. Indicators include realized risks such as data exfiltration and credential sharing, and predictive signals such as financial distress and disgruntlement. When signals overlap for an individual, Falcon can add that employee to a watchlist and share a risk profile with security, HR, legal and compliance teams. Intervention options include manager notification, access revocation, or HR or legal engagement. On the Behavox platform, controls can also block sensitive transfers, quarantine attachments or hold messages for review. Falcon can run as an API overlay on existing infrastructure or on the Behavox platform, which uses Quantum for data aggregation, archiving and surveillance. Full-platform deployment is described as single-tenant on GCP or AWS, with customer-held KMS keys and support for 50+ languages. The maker says alerts are explainable and human-reviewed, and Falcon does not make employment decisions on its own. Pricing is on request.

Bottomline Internal Threat Management monitors user behavior across systems to help organizations identify unusual activity by insiders or intruders before it becomes disruptive. It captures behavior in real time and applies machine learning to find anomalies and reduce false-positive alerts. The agentless product collects data from the network without installing software on employee devices, covering legacy systems, SaaS, and web applications. Dashboards support searches across platforms and review of alerts across geographies, including searches against lists such as VIP names or known fraudulent accounts. Record and Replay reconstructs sessions screen by screen for investigators, security officers, and internal auditors. Recordings are encrypted and secured for later use, including as court evidence. Recorded actions can be processed by Bottomline’s analytics engine or sent to data lakes or third-party analytics. Use cases include identifying unauthorized client-data changes and employee policy violations such as snooping. The solution is presented for financial institutions, government, insurance, and telecom. It runs on the web; pricing is available on request.