How Data Loss Prevention Systems Help Monitor Privileged Users
By Sergio Bertoni, Leading Analyst at SearchInform
Every corporate IT environment has privileged users. Some work in-house, such as system administrators; others are external contractors or outsourced developers. All have elevated access to IT resources, which makes them a potential source of risk.
In October 2025, Intel filed a lawsuit alleging that one of its engineers copied nearly 18,000 company files, including some marked “Intel Top Secret,” to personal network storage. According to the complaint, the alleged transfer took place after he received notice of termination but while he was still employed.
How can companies reduce these risks? In this article, I explain how a SearchInform client, a large engineering and construction company, used DLP to detect an insider threat and combined DLP with PAM to strengthen its oversight of privileged users.
Was It an Administrator’s Mistake?
One of the client’s terminal server farms went offline. Infrastructure monitoring showed no technical faults, and its security systems had registered no suspicious activity. The IT administrator responsible for the service suggested that his username and password might have been exposed because his home network had supposedly been hacked.
To establish what had happened, the client’s security team closely examined the administrator’s activity in Server Manager, the Windows Server administration tool used to disable the terminal farm. They also checked network logs from the remote access systems and all available security logs. SearchInform Risk Monitor, a Next-Gen DLP system, then showed which processes were running on the administrator’s computer at the same time as Server Manager. This was made possible by ProgramController, the application monitoring module that tracks user activity on workstations.
The investigation found no suspicious processes. The administrator had accidentally deleted the farm in Server Manager himself but had not reported the mistake to either his manager or the information security team. The investigation ruled out unauthorized access and confirmed that the service disruption had resulted from an administrative error. The reasons behind the administrator’s behavior were then left for management to address.
Spyware on an IT Employee’s Computer
SearchInform Risk Monitor detected another incident. Through ProgramController, the security team discovered that an IT department employee had installed unlicensed screenshot software on his workstation. MailController, the email monitoring module that tracks incoming and outgoing messages, revealed a suspicious feature of the software: every screenshot it captured was sent via SMTP to a domain belonging to its developer.
Using ProgramController, the team identified the application’s file hashes, how it had been installed and other relevant details. They then configured process-blocking rules in Risk Monitor and the company’s antivirus solution to prevent the software from being used again. In effect, this was spyware exfiltrating data. Because the person using it worked in IT, the screenshots could have contained sensitive details about the company’s infrastructure, creating a risk of a subsequent compromise.
The DLP system helped neutralize the threat. The team blocked the software and used Risk Monitor to check for signs of critical data exposure. The investigation found no evidence that critical information had been leaked.
Why Monitoring Matters
The company has a large team of administrators, developers, testers and other IT specialists. All have elevated access to corporate systems, creating additional information security risks. The company therefore places them in higher-risk groups. To monitor their activity and manage those risks, it has introduced strict internal procedures:
- Employees receive elevated access to IT systems only after submitting a request. Each request must be justified, specifying why access is needed, the required access level and, in some cases, the exact period for which access is needed. Every request must be approved by the heads of both the IT and information security departments.
- The company regularly audits all systems for excessive access rights and unnecessary user accounts. Information security staff are subject to the same checks. For these audits, it uses a privileged access management (PAM) system, which provides centralized management of privileged accounts, including passwords and access keys. This reduces the likelihood of unauthorized access to corporate resources.
- Privileged users are people first. They can make mistakes, deliberately disrupt operations, cause data leaks and more. That is why the company monitors every user, without exception, using Risk Monitor. The solution helps its information security team conduct detailed investigations and establish what happened when something goes wrong.
Risk Monitor also has dedicated tools for monitoring users with elevated privileges. For example, it allows the company to define safe operating scenarios for remote access tools, monitor their use and block dangerous actions.
A comprehensive approach works best for monitoring privileged users. It combines organizational measures with technical controls. In the client’s case, DLP and PAM systems have proved to be an effective combination. DLP provides visibility into privileged users’ activities, helps detect suspicious behavior, and supports detailed security investigations, while PAM complements these capabilities by managing privileged access.
ABOUT SEARCHINFORM
SearchInform is an information security and risk management product vendor as well as an MSS provider. The company's clients are more than 4000 companies in 20+ countries. Today, the team has products and services for comprehensive protection against insider threats at all levels of corporate information systems: FileAuditor (the DCAP class solution); DLP system with extended functionality; Risk Monitor (advanced platform for internal threat mitigation); SIEM system, Information Security outsourcing service.
