It's 100% legal and quite common. It's their network, (usually) their computers, their time. Mostly organizations doing that are looking for threats to the busi

It's 100% legal and quite common. It's their network, (usually) their computers, their time. Mostly organizations doing that are looking for threats to the business and not employee behavior though, of course YMMV.