DTEX Insider Risk Management vs Microsoft Purview Insider Risk Management

DTEX Insider Risk Management helps enterprise security teams examine user behavior and activity around data and AI to identify potential insider-driven breaches. It offers preconfigured and customizable behavior indicators, user baselines, anomaly detection, and risk scoring. Investigations can draw on MITRE ATT&CK-aligned profiling and endpoint telemetry such as event logs, registry changes, and credential usage to examine signs including lateral movement and privilege escalation. Preconfigured DLP patterns flag risky behavior, while data lineage tracks file interactions and changes. A threat-hunting engine supports searches across insider data using an open query language and customizable visualizations. The platform covers users, endpoints, servers, applications, data, and AI activity across Linux, macOS, Windows, and web. DTEX describes pseudonymization that masks personal identifiers and can be reversed for escalated investigations. It reports metadata collection of about 5 MB per user per day, with deployment materials giving a 3–5 MB range. Pricing is available on request.

Microsoft Purview Insider Risk Management has no write-up on Specifiction yet; its figures are above.