It's not really about alternatives, what would the spyware stop that a simple Daemon that version checks your device won't? If you're working from home and you

It's not really about alternatives, what would the spyware stop that a simple Daemon that version checks your device won't? If you're working from home and your device gets owned, and the attacker just sits there slowly slurping data as you go about your business... Chances are you're not going to detect it, but if you did you'd probably notice it's running when it's not supposed to and it's sending network traffic when not actively used. If someone uses a laptop breach to go look at data you wouldn't normally look at ( or tons of records ) an audit log would give that away. So really to do security well you have to profile the role. Why are you looking up customer record abc123? Trying to see what your girlfriends doing, or is it because they've called the customer support line? You basically have to define what does misuse look like and protect for that. Back on the slow slurp, hardend immutable devices that are regularly updated with limited Auth sessions would likely contain the breach. Same deal on servers, you harder to stop it, but you monitor for when it happens. Do people really monitor though? Some, sure, but your average org buys a tool the fails configure it with any sort of context.