BalaBit Releases Blindspotter: Real-time, User-behavior Analytics Tool

BalaBit announced that its next-generation IT security tool, Blindspotter is now generally available. Blindspotter is a real-time, user behavior analytics (UBA) tool that analyzes user activities and identifies suspicious events occurring throughout IT systems. It is designed to help organizations mitigate the impact of advanced persistent threats (APTs) or identify malicious internal activity and to speed up the investigation process of any suspicious activity.

Blindspotter tracks and visualizes user activity in real-time to provide organizations with a better understanding of what is really happening on the network. The solution works by collecting and analyzing user-related events and user session activity in real-time or near real-time. It then compares every action to the corresponding baseline of users and their peers to spot anomalies in their behavior -- such as an administrator logging in outside of their normal hours. Blindspotter is even capable of detecting abnormality on the level of issued commands. This means that, if a system administrator uses a command that is different from the generally used command set, Blindspotter will alert the security team. Once this has been detected, Blindspotter can automatically react to minimize the impact of any threat.

It is designed to meet today's key security challenges and alert organizations to key threats, for example:

Detection of hijacked accounts: The activities of an attacker who has compromised a legitimate account will differ significantly from a normal user's activity; external attackers will typically try to map the IT system by accessing various systems to probe for available services or download a large amount of data, which would be of value to them. Blindspotter is able to detect and alert security analysts to deviations of this kind.

Detection of misuse of privileges: Blindspotter can help to detect if a user with high privilege rights has attempted to steal company data to copy or modify sensitive company data that is not required for his job. In this way the data breach can be prevented.

Detection of automated system account misuse:Automated system accounts are typically created by administrators to repeat regular tasks such as backing up the database or restarting certain services overnight. Automated system accounts increase the efficiency of administrators' jobs, however, to make their job easier, in many cases they take the risk to use their own credentials. This is a security risk; in the event that the script is hacked, the attacker not only has the account details of the system administrator but also gains access to all the services that the administrator has. Using Blindspotter, it is possible to distinguish between accounts used by automated jobs and humans.

Screen Content Analysis:Used in conjunction with Shell Control Box -- BalaBit's privileged activity monitoring appliance -- Blindspotter can also analyze screen content, including issued commands and applied software or any textual data that appears on the screen. This enables the detection of any anomalies, which are the obvious signs of an APT-attack or a serious misuse of privilege.

"The reality for most organisations is that security threats already lurk inside their perimeter, whether it's a sophisticated external attacker who has gained access to an internal account or a malicious insider attempting to steal data," said Zoltán Györkő, CEO of BalaBit. "In the past, spotting attacks from within the perimeter has been notoriously difficult. Blindspotter is designed to close this security gap, and protect critical data, without slowing down a business's day to day operations."

 

 

Featured

  • Security Today Announces The Govies Government Security Award Winners for 2025

    Security Today is pleased to announce the 2025 winners in The Govies Government Security Awards. The awards honor outstanding government security products in a variety of categories. Read Now

  • Survey: 60 Percent of Organizations Using AI in IT Infrastructure

    Netwrix, a cybersecurity provider focused on data and identity threats, today announced the release of its annual global 2025 Cybersecurity Trends Report based on a global survey of 2,150 IT and security professionals from 121 countries. It reveals that 60% of organizations are already using artificial intelligence (AI) in their IT infrastructure and 30% are considering implementing AI. Read Now

  • New Research Reveals Global Video Surveillance Industry Perspectives on AI

    Axis Communications, the global industry leader in video surveillance, has released its latest research report, ‘The State of AI in Video Surveillance,’ which explores global industry perspectives on the use of AI in the security industry and beyond. The report reveals current attitudes on AI technologies thanks to in-depth interviews with AI experts from Axis’ global network and a comprehensive survey of more than 5,800 respondents, including distributors, channel partners, and end customers across 68 countries. The resulting insights cover AI integration and the opportunities and challenges that exist with regard to security, safety, business intelligence, and operational efficiency. Read Now

  • SIA Urges Tariff Relief for Security Industry Products

    Today, the Security Industry Association has sent a letter to U.S. Trade Representative Jamieson Greer and U.S. Secretary of Commerce Howard Lutnick requesting relief from tariffs for security industry products and asking that the Trump administration formulate a process that allows companies to apply for product-specific exemptions. The security industry is an important segment of the U.S. economy, contributing over $430 billion in total economic impact and supporting over 2.1 million jobs. Read Now

  • Report Shows Cybercriminals Continue Pivot to Stealthier Tactics

    IBM recently released the 2025 X-Force Threat Intelligence Index highlighting that cybercriminals continued to pivot to stealthier tactics, with lower-profile credential theft spiking, while ransomware attacks on enterprises declined. IBM X-Force observed an 84% increase in emails delivering infostealers in 2024 compared to the prior year, a method threat actors relied heavily on to scale identity attacks. Read Now

New Products

  • Connect ONE’s powerful cloud-hosted management platform provides the means to tailor lockdowns and emergency mass notifications throughout a facility – while simultaneously alerting occupants to hazards or next steps, like evacuation.

    Connect ONE®

    Connect ONE’s powerful cloud-hosted management platform provides the means to tailor lockdowns and emergency mass notifications throughout a facility – while simultaneously alerting occupants to hazards or next steps, like evacuation.

  • AC Nio

    AC Nio

    Aiphone, a leading international manufacturer of intercom, access control, and emergency communication products, has introduced the AC Nio, its access control management software, an important addition to its new line of access control solutions.

  • Hanwha QNO-7012R

    Hanwha QNO-7012R

    The Q Series cameras are equipped with an Open Platform chipset for easy and seamless integration with third-party systems and solutions, and analog video output (CVBS) support for easy camera positioning during installation. A suite of on-board intelligent video analytics covers tampering, directional/virtual line detection, defocus detection, enter/exit, and motion detection.