Not as evil as they make it sound. Process Execution, detailed timestamps, and network metadata capture are core features of every EDR tool (CrowdStrike, MDE, S

Not as evil as they make it sound. Process Execution, detailed timestamps, and network metadata capture are core features of every EDR tool (CrowdStrike, MDE, SentinelOne, etc) that exists. They can just be abused to monitor user behavior, in addition to threat hunting or malicious activity. Telemetry isn't inherently evil, but organizations need to establish privacy and usage governance around security tools to prohibit abuse.