If you bought insider-threat software to see who's working, you overbought.
Teramind is a serious security product. It logs keystrokes, records the screen, reads email and instant messages, applies OCR to what is displayed, and enforces data-loss-prevention policy. For an organisation with a genuine insider-threat mandate, that is the job and it does it thoroughly.
A great many organisations bought it to answer a much smaller question — are our remote staff actually at work — and inherited a forensic evidence store they now have to secure, justify and defend. That is the mismatch this page is about.
- You have a real insider-threat or data-exfiltration mandate, with people whose job is to act on it.
- You need DLP enforcement — blocking a file leaving by USB, email or upload.
- A regulator or a client contract requires session recording you can replay as evidence.
- You are investigating specific individuals under a documented, approved process.
- Your fleet spans Windows, macOS and Linux.
- The question was always "is this person working", and everything else came in the box.
- You are holding recordings and keystroke logs nobody has ever reviewed.
- The rollout cost you trust you would like back.
- You want a defensible answer for the works council, the union or the privacy officer.
- Your fleet is Windows and you still need self-hosting.
Side by side
Most of Teramind's capture features are configurable and can be narrowed to particular users or turned off. The rows below describe what the platform can do, because that is what you are deploying to every endpoint and what you will be asked about.
| Capability | MunkiSee | Teramind |
|---|---|---|
| Keystroke logging | Not possible Input events are used only to answer "has anything happened recently", then discarded on the device. They never leave it. |
Yes Full keystroke capture, searchable. |
| Screen recording and screenshots | Not possible | Yes Continuous session video, replayable, plus OCR of on-screen content. |
| Email and instant-message content | Never | Yes |
| File transfer and USB monitoring | No | Yes With blocking, not just recording. |
| DLP policy enforcement | No | Yes The core of the product. |
| Covert / hidden agent | Impossible by design The tray icon always shows the true tracking state and cannot be suppressed by an administrator. |
Supported |
| Real-time fleet presence | Yes Active, idle or offline for every device, refreshed every 5 minutes. This is the whole product. |
Yes Among a great many other things. |
| Tracking confined to defined hours | Yes Organisation, team or individual. Outside them nothing is written at all. |
Policy-dependent |
| Self-hosting | Yes, on Enterprise | Yes |
| Platforms | Windows only | Windows, macOS, Linux |
| Time to deploy across a fleet | An afternoon Silent install via Intune, SCCM or one command line. |
A project Policy design, tuning and legal review, as befits its scope. |
| What a subject-access request returns | A list of status changes | Potentially recordings, keystrokes and messages |
Collected data is a liability as well as an asset
Every recording you hold is something you must secure, retain to a schedule, disclose on request, produce under subpoena, and explain after a breach. If it is being used to catch data theft, that cost buys something. If it is sitting unwatched because you only ever wanted attendance figures, it is pure exposure — and it is exposure that grows every day the agent runs.
MunkiSee's entire dataset is a series of status changes: this device became idle at 14:32 and active again at 14:51. A subject-access request returns that list. There is no footage, no transcript, no message content, because none was ever captured.
Proportionality is the argument you will actually have
When staff, a union or a works council challenge monitoring, the question is rarely "is this legal". It is whether the intrusion is proportionate to the purpose. Session recording deployed to answer an attendance question is very hard to defend on that test, and the conversation tends to be remembered long after the software is gone.
Presence measurement, visible on every machine, confined to declared working hours, collecting no content at all, is a far shorter conversation. In several Australian states, employers must also give written notice before computer surveillance begins; a tool that announces itself with a permanent tray icon makes that notice easy to honour rather than something to work around. It does not replace the notice — take your own legal advice on that — but it stops the two being in tension.
You can run both
These are not mutually exclusive, and for some organisations the right answer is neither product alone. Keep a security-grade tool scoped narrowly to the roles that genuinely warrant it — privileged access, finance, anyone handling regulated data — and measure the rest of the fleet with something that collects almost nothing. Most of the cost and nearly all of the friction in this category comes from applying one policy to everybody.
Where Teramind wins, honestly
Everything above assumes you do not need what it does. If you do — if you have to prove what left the building, block an exfiltration in progress, or hand an investigator a replayable session — MunkiSee is not a substitute at any price, and swapping one for the other would be a serious mistake. We do not do DLP, we do not record anything, and we never will.
Self-hosting, if that is why you chose Teramind
MunkiSee Enterprise runs entirely on your own hardware. Activity data never leaves your network; the only thing sent out is a licence check and a seat count, and offline builds remove even that.
How the licence works →Try it alongside what you have
30 days, up to 10 seats. Run it on one team and compare what each tool actually told you.
Start a free trialQuestions people ask before switching
Can MunkiSee run covertly if we need it to?
No, and that is not a gap we intend to close. The tray icon reflects the real tracking state permanently and no administrator setting suppresses it. If covert monitoring is a requirement, we are not the right product.
We need evidence for a specific investigation.
MunkiSee can show that a device was or was not in use at a given time, and replay a day as active, idle and offline periods. It cannot show what was done. For anything beyond attendance, you need a forensic tool, and it should be scoped to that investigation rather than left running fleet-wide.
How do we handle the internal announcement?
Tell people exactly what is collected — the full list is short enough to fit in an email — and point them at the tray icon so they can verify it themselves. Replacing a heavier tool is usually welcomed rather than resisted. Written notice obligations vary by state, so confirm yours with your own adviser.
Can we still spot someone faking activity?
Yes. Standard and above flag the input signatures typical of mouse jigglers and auto-clickers, with a threshold you set per department, raised for review rather than as an accusation. It is a prompt to have a conversation, not a verdict.
Comparison reviewed August 2026 against Teramind's publicly available product documentation. Teramind is a trademark of its owner and is used here only to identify the product being compared; MunkiSee is not affiliated with or endorsed by them. Nothing on this page is legal advice — surveillance notice obligations differ by state and by circumstance, so take your own. Products change: verify anything that matters to your decision on the vendor's own site, and tell us if something here has gone out of date.
Collect the answer. Not the evidence.
Run it on one team for a month and see whether anything you actually used is missing.