Access, file, and activity monitoring

Manage, monitor, protect

Monitoring rarely fails for lack of data. In 75% of breaches, the signals needed to catch the attack were already sitting in company logs, scattered across separate systems and never correlated (ENISA, View on Cybersecurity in the Frontier AI Era, 2026). The hard part is seeing them in time, on the data that matters, before it leaves the company.

CyberGrant moves monitoring from the perimeter to the file. Every access, every action on a document, every credential used leaves a readable trace tied to the data itself, not to an isolated log in a separate system. Control does not stop when a file leaves the company: you know who opens it, from where, and you can act while it happens.

DEVICE CONTROL

Continuous control over activity on physical and virtual machines, including RDP

In 2017 a Waymo engineer with fully legitimate access downloaded 14,000 confidential files before leaving for a competitor. No perimeter was breached and no alert fired on the mass download: the activity came from inside, from an authorized user.

That is the blind spot of perimeter monitoring, which cannot tell a normal access from an abuse in progress.

RemoteGrant applies more than 20 policies directly on the endpoint, raises alerts on mass downloads and anomalous behavior, blocks unauthorized USB devices, and makes the RDP port invisible to scanners (patented technology), with single-user access and encrypted RDP transfers.

It catches the anomaly and lets you react in real time, before it turns into exfiltration.

SHARED FILES

Control over what happens to a file even after it leaves the company

Once a document crosses company boundaries, traditional control ends. Download, editing, re-sharing with third parties: after the file is handed over, you no longer know who does what with it, and you have no way to undo it.

FileGrant keeps protection inside the file. You can authorize, restrict, or revoke download, editing, and re-sharing in real time, even after sending, and see every action as it happens. The document stays accessible only to those who genuinely need it, wherever it travels.

AUDIT TRAIL

A complete chain of custody on every file and folder, in real time

The median time between a first unauthorized access and data exfiltration is 72 minutes (ENISA, View on Cybersecurity in the Frontier AI Era, 2026). A log you read the day after the incident helps little. NIS2, DORA, and Article 32 of the GDPR require knowing who did what while it happens, with traceability that holds up as evidence.

FileGrant records every activity on files and folders in real time and ties it to the user, with On Behalf mode that lets an administrator access files for audit and incident response while leaving a trace of that access too. The chain of custody stands as evidence in an audit, with no after-the-fact reconstruction needed.

CREDENTIAL ACCESS

Who accesses which credentials, when, and from where, always tracked

Credentials are the first thing an attacker looks for after getting in: InfoStealer activity grew 84% in 2024 (Clusit Report 03-2026). Passwords shared in the clear over chat, files, or spreadsheets leave no record of who used them, so when you need to trace where the abuse started, the log does not exist.

SecretGrant, the credential management module of FileGrant, treats every password like a file: encrypted, with permissions, expiration, and access logs. You see who opened a credential, when, and from where, and you can revoke it at any time without having to change it.

EMAIL CHANNEL

Tracking and revocation of messages even after they are sent

Email is still the easiest channel for data to leave through, and the hardest to monitor. Once you hit send, you do not know whether the message was opened, by whom, or whether it reached the wrong address. 94% of companies suffered an email-related incident in the past year (Email Security Risk Report 2024).

EmailGrant, the secure messaging module of FileGrant, tells you who opened a message, when, and from which IP, and lets you revoke it or make it expire even after sending. Attachments inherit the permissions and restrictions of the file, so tracking does not stop at the message body.

ANOMALY DETECTION

Private AI reads the activity and flags suspicious behavior

More sources to monitor means more noise. Generic alerts and false positives are why teams stop watching their dashboards, and that is how a real anomaly slips through among a thousand signals.

AIGrant brings private AI into monitoring: it automatically classifies confidential documents, applies no-download policies on sensitive files, and flags out-of-pattern activity, with every interaction logged and no data leaving the company.

FAQ

What is file-centric monitoring, and how is it different from traditional DLP?

File-centric monitoring tracks activity at the level of the individual file, not the network perimeter. Every access, open, edit, or share stays tied to the document and the user, inside and outside the company. Traditional DLP watches the network boundary and loses sight of the data as soon as it leaves, while CyberGrant's file-centric model keeps seeing and controlling the file wherever it goes.

How is CyberGrant monitoring different from a SIEM? A SIEM collects and correlates logs from many systems to give a centralized view of security events. CyberGrant monitoring works on the data itself: it records who does what on every file, credential, and message, and lets you act in real time, for example by revoking access. The two work together, since CyberGrant can feed a SIEM with file-level events through its audit API export.

Is CyberGrant compatible with Microsoft 365, SharePoint, and Purview? Yes. CyberGrant works alongside your existing environment rather than replacing it. FileGrant adds the protection and monitoring your systems lack, namely persistent encryption on the file, post-sharing revocation, and an audit trail tied to the data, without removing SharePoint, OneDrive, or Purview. Teams already on the Microsoft stack keep using it, with file-centric control added on top.

Does CyberGrant monitoring meet NIS2, DORA, and GDPR requirements? NIS2 requires detection and incident-handling capabilities, DORA mandates traceability and operational resilience, and Article 32 of the GDPR calls for adequate measures including logging and access control. FileGrant's real-time audit trail provides the traceability these obligations require, with a per-file, per-user record you can use as evidence during an audit or an incident response.

Can you revoke access to a file or a message after sharing it? Yes. With FileGrant you can revoke download, editing, or re-sharing of a file even after sending, and with EmailGrant you can revoke or expire a message that has already been sent, even once it has been opened. Protection lives in the file, so revocation takes effect wherever the document is, not only inside the corporate network.

How are company credentials monitored? SecretGrant, the credential management module built into FileGrant, treats every password as an encrypted file with permissions and logs. It records who opened a credential, when, and from where, and lets you revoke access at any time without changing the password. This closes the common blind spot of passwords shared over chat or files, where no record of who used them exists.

Does AI monitoring send data to an external cloud? No. AIGrant is a private, on-premise AI: it runs on the company's own infrastructure, and the documents, logs, and activity it analyzes do not leave the corporate perimeter. The model is dedicated to your organization and works only on your data, so you get intelligent monitoring without exposing sensitive information to public AI services like ChatGPT.

Monitor and control your data, wherever it goes