Making a case for job abandonment is much easier than proving mere underperformance. The keylogger isn't strictly necessary. My trade secret: look at authentic

Making a case for job abandonment is much easier than proving mere underperformance. The keylogger isn't strictly necessary. My trade secret: look at authentication counts. Here in the US, company policy mandates that the employee lock the screen when away from desk and we have timeouts to enforce it (for PCI). Labor law requires 3-4 breaks per shift. So when arriving at their desk and returning from each break, all employees should have an absolute minimum of 3-4 authentications logged per shift. Realistically it's going to be way more than that because people get up and do stuff all the time (which is fine, and desirable, since it at least suggests activity), but if someone has less than the absolute minimum number of logins they'd accrue if they were physically chained to their desk, they're either not actually at their desk, they're violating labor law by not taking breaks (while also somehow underperforming), or they installed a mouse jiggler (which I'd then look for and get them for "installing software/hardware to obfuscate evidence of job abandonment"). This is all trivial to do with Defender KQL or whatever SIEM you have. No spyware necessary.