Balabit Blindspotter

Balabit IT Security is an international information security vendor headquartered in Luxembourg, founded in 2000 in Hungary, and still operating R&D centers there alongside sales offices across Europe, the US, and Russia. The company is widely recognized for syslog-ng, a de-facto standard log management tool for Unix-like platforms with over a million installations, as well as syslog-ng Premium Edition. Another core area is Privilege Management (PxM), including the Shell Control Box (SCB) solution for privileged activity monitoring.

Blindspotter, released in 2015, expands Balabit’s portfolio with real-time user behavior analytics designed to identify unknown threats and suspicious activities inside corporate networks. It aligns with the company’s Contextual Security Intelligence (CSI) concept, emphasizing monitoring and contextual detection over adding restrictive controls that could hinder business performance. With weakening network perimeters and attacks that mix technical exploits with social engineering, user identities become central to defense; anomaly detection via correlation analysis is positioned as a feasible approach where pattern-based tools fall short, including against phishing and insider threats.

Blindspotter collects user activity traces from many sources, enriches them with contextual data about users, hosts, and applications, and applies machine-learning algorithms in real time to build and update behavioral baselines without predefined rules. It presents insights through a browser-based dashboard and assigns risk scores to anomalies while maintaining evolving user risk profiles for improved detection and forensics. The March/April 2016 release adds scripted activity detection, biometric analysis of mouse and keystroke dynamics, and OCR-based screen content analysis extending visibility into Windows and virtual desktop environments. The product integrates tightly with syslog-ng and SCB, supports SIEM and IAM integrations (including automated account disabling), but lacks cloud deployment support and offers limited risk-model fine-tuning, making it primarily suited to large on-premise enterprises.

• Balabit IT Security is headquartered in Luxembourg and was founded in 2000 in Hungary.
• Research and development centers remain in Hungary.
• syslog-ng is used in over a million installations worldwide.
• Blindspotter was released in 2015 as a real-time user behavior analysis solution.
• The reviewed newer version was released in March 2016.
• Blindspotter builds and updates behavior baselines automatically without predefined rules.
• The product provides a centralized browser-based dashboard with real-time and historical insights.
• The April 2016 release includes scripted activity detection, biometric input analysis, and OCR-based screen content analysis.
• Blindspotter can integrate with IAM systems and can disable user accounts as part of mitigation workflows.
• The current release has no support for cloud deployments.

• “additional levels of security controls that restrict business performance should be avoided and more efficient monitoring tools should be deployed instead.”
• “users (or rather their identities) have become the most critical part of a company’s security infrastructure.”
• “utilizing correlation analysis to look for anomalies in user behavior and thus detecting previously unknown suspicious activities remains the only feasible approach to this problem.”
• “A centralized browser-based dashboard provides both real-time and historical insights into user behavior”
• “Blindspotter does not require any predefined rules to detect anomalies”
• “behavior baselines… are created and updated automatically using available historical information.”
• “a potential downside is that administrators have less direct control over the risk model implemented by the solution.”
• “Top suspicious activities can trigger alerts or initiate automated mitigation workflows.”
• “Together, these three products comprise Balabit’s Contextual Security Intelligence (CSI) Suite”
• “the product is primarily targeted at large enterprises with established security infrastructures.”