Bossware. The 12 tools your employer is probably running on your work laptop.

The twelve tools, and what each captures

The market for employee monitoring software more than tripled between 2020 and 2025. The product names rotate. The capabilities cluster into a few categories that overlap more than the marketing suggests.

Hubstaff

Random screenshots every ten minutes by default, configurable down to once per minute. Active-window logging. Mouse and keyboard activity counts. Optional time-tracking that pauses when no input is detected for two minutes. Marketed primarily to agencies billing hourly. Often runs visibly with a tray icon.

Time Doctor

Similar to Hubstaff. Adds website categorization (productive vs unproductive) and an alert if you spend too long on the wrong category. Webcam screenshots optional. Generally visible to the user but sometimes hidden in stealth mode if the employer enables it.

Teramind

The most invasive of the consumer-grade tools. Continuous keylogging including passwords typed. Email content capture. Clipboard monitoring. Recording of every web page including content. Often runs in stealth mode invisible to the user. The full Teramind deployment captures essentially everything that happens on the device.

Veriato

Originally Cerebral, now Veriato. Marketed for insider-threat detection rather than productivity. Captures screenshots, keystrokes, file movements, USB device activity, and email. Adds AI-driven behavioral analysis flagging anomalies. Used in regulated industries (financial services, government contractors).

ActivTrak

Lighter touch. Tracks active applications, websites, and time-on-task. No keylogging by default. Webcam capture optional. Marketed as productivity analytics rather than surveillance. Often visible. Some employers run it with the user-visibility setting disabled.

Microsoft Productivity Score and Workplace Analytics

Built into Microsoft 365 Enterprise. Aggregates data from email, Teams, Outlook calendar, file activity. Reports at individual or team level depending on the licensing tier. The data flow is to your employer through Microsoft, with no separate installation required. If you use a Microsoft 365 work account, this is running.

Other tools in the same category

InterGuard, Awareness Technologies, FlexiSpy Worker, Pearl Echo, RescueTime Pro Team, and Crossover Worksmart make up the rest of the top twelve. Each has its own variation on the same themes: screenshots, keystrokes, app and web activity, time-on-task. The differences are in stealth, in the AI layer for behavioral analysis, and in the per-seat pricing.

How to detect it on Windows

Three checks, none of which require admin rights you typically have on a managed device.

Open Task Manager, Details tab, and look at running processes. Sort by name. The bossware tools either run with their product name visible (Hubstaff.exe, Teramind.exe) or with deliberately obscured names (random characters, generic system-sounding names). Cross-reference any unfamiliar process with a Google search. Stealth-mode tools usually have a vendor signature in the process properties even if the name is obscured.

Open Settings, Apps, Installed apps. Sort by install date. Anything installed by your IT department appears here. Bossware that uses MSI installers shows up in this list. Bossware that uses driver installation often does not, but the next check catches those.

Run Microsoft Sysinternals Autoruns (download from learn.microsoft.com if not already present). Autoruns shows every program that runs at startup, every browser extension, every scheduled task, every service. Bossware persists through one of these mechanisms. Sort by publisher: anything signed by an unfamiliar vendor is worth checking.

How to detect it on macOS

The macOS detection is harder because the OS hides system processes by default. Three checks that work.

System Settings, Privacy and Security, Screen Recording. Any application listed here can capture your screen. Many bossware tools require this permission and you (or someone running the device as you) granted it at installation. Check Microphone and Camera lists in the same area for the same reason.

System Settings, Profiles. Configuration profiles installed by an MDM (Mobile Device Management) appear here. The MDM is the channel by which most enterprise bossware is deployed on Macs. The profile lists the management server and, sometimes, the policies. Some employers configure their MDM to suppress the user-visible profile listing, but the underlying profile installation is still visible to a determined user.

Activity Monitor, then look at the network tab and the energy tab. Bossware uploads screenshots and logs at regular intervals; if a process is uploading consistent data when the device is idle, it warrants investigation.

The legal frame, by jurisdiction

The framework varies. The shape is consistent.

In the United States, federal law (the Electronic Communications Privacy Act) generally permits employer monitoring of employer-owned devices, especially with disclosure. Disclosure can be a paragraph buried in the employee handbook the user signed at hire. State law adds carve-outs in California, Connecticut, Delaware, and New York that require explicit notice. The notice is sometimes given. Often it is not.

In the European Union, GDPR and the e-Privacy directive apply. Monitoring of an employee requires a documented legal basis, proportionality, and prior information. Stealth deployment of full-keylogging tools is generally unlawful in most member states, even on employer-owned devices. Enforcement is uneven. Affected employees who file complaints with their data protection authority typically prevail.

In the United Kingdom, the UK GDPR plus the ICO’s employment monitoring guidance apply. The standard is similar to the EU. Recent ICO enforcement against several bossware deployments has narrowed the practical use of the most invasive tools.

What you can and cannot do about it

The realistic answer is unsatisfying. On a device your employer owns, you have limited recourse. The list of options is short.

Treat the work device as a work device. Personal email, personal banking, personal medical, personal anything goes on a personal device on a personal network. Maintaining the boundary is the most reliable protection. The threat-modeling logic is the same one we walk through in how to build a threat model in 20 minutes: separate compartments contain damage when one compartment is breached.

Document what you find. If you discover stealth bossware on your device that was not disclosed in your employment paperwork, document the discovery (screenshots of the running process, dates, time, and the disclosed vs actual state). The documentation may matter later if employment circumstances change.

If you are in the EU or UK and you find stealth deployment of full-keylogging or webcam-capture tools that violates the legal threshold, you can file a complaint with your national data protection authority. The complaint can trigger an investigation that has, in several documented cases, forced employers to remove the tools across their workforce.

FAQ

Can I tell if my employer is using ChatGPT-style AI to read my Slack DMs?

Increasingly hard. Several enterprise products (Aware, Theta Lake, Hanzo) ingest Slack content and run analysis at the API level, with no installation on your device. Detection on your end is impossible. The relevant signal is what your IT or security team has communicated about content monitoring. If they have not said, ask. Most employers will answer. Slack DMs in workplaces with these tools are not private.

Does using a personal VPN on the work laptop hide my activity?

From the network it does. From the bossware on the device it does not. Bossware reads what is happening on the device itself: which app is open, what the screen shows, what is typed. The VPN affects the network path. The screenshot of your monitor does not depend on the network path.

If I work on my own device with a corporate browser profile, am I monitored?

Less so. A corporate browser profile (Chrome managed by your employer’s policy) can capture browsing history, downloads, and certain extensions on the corporate sites and accounts you log into. It generally does not extend to other applications on the device. The exposure is narrower than full bossware on a corporate-issued machine. Still real.

Can I uninstall bossware?

Almost never on a managed device, and trying without authorization is usually grounds for termination. The realistic frame is that the bossware is part of the device’s configuration and will reinstall through the management channel even if you remove it locally. Detect, document, do not engage.

---

There’s no perfect setup. Anyone selling you perfect is selling fear. The goal is simple: make yourself a harder target than the person next to you.