Presence Authority
Stop IP and data theft through the screen
Card data, patient records, deal files, design IP. Credentials prove access to all of it. They never prove the person. Presence Authority verifies who is at the screen for the whole session and closes every exfiltration path off it.
The problem
Every screen showing sensitive data is a way out, and leaked data finds a buyer
An employee can sign in, pass MFA and still be the leak. Whether they snap a photo on purpose or a bystander reads over their shoulder by mistake, your file and network controls never see it.
MFA, DLP and your SIEM see none of it.
In the news
Screen theft is already making headlines
Valid credentials, authorized access and data that left through a lens or a capture.
- Seoul Economic DailyApr 29, 2026
Ex-chip engineer gets 10 years over 2nm secrets
Prosecutors said the process material moved by phone photography.
- U.S. Dept. of JusticeN.D. Cal.
Engineers charged with photographing screens to steal trade secrets
Hundreds of photos over months, taken to avoid detection by data controls.
- PetaPixelAug 17, 2026
Hidden camera smuggled in to steal DRAM R&D
Aimed at documents opened on virtual machines with the engineer's own login.
- BleepingComputerSecurity
Insider breach tied to leaked support-tool screenshots
Bribed support agents' screenshots exposed customer identity records.
91%
of visual hacking attempts captured sensitive information
Ponemon / 3M, 2016
52%
of visually hacked information came from employee screens
Ponemon / 3M, 2016
67 days
average time to contain an insider incident
DTEX / Ponemon, 2026
$4.91M
average cost of a third-party access breach
IBM Cost of a Data Breach
Headlines paraphrased. Charges are allegations; defendants are presumed innocent.
Capabilities
The same screen, protected
Six controls ring every sensitive session, below the application layer, from sign-in to the audit record.
Continuous presence verification
Continuous user verification using face and posture.Liveness and presence
Rejects photos and deepfakes. Locks when the user leaves.Viewer and lens detection
A phone or a second face blanks the screen.- Identity
- Verified
- Room
- Clear
- Capture
- Blocked
Capture and export control
Screenshots and screen share blocked at the session.Forensic watermarking
An invisible mark of user, time and IP on every frame.Evidence and traceability
Every event named, attested and sent to your SIEM.Continuous presence verification
On-device AI confirms the person at the screen is the person who authenticated, for the whole session rather than at login.
Bound to the IdP and MFA you already run.
Rejects deepfakes, printed photos and replayed video.
Applies a policy-driven blank, lock or step-up.
The screen comes back the moment the verified user returns.
Matches the user to the HR record of hire.
Keeps an unbroken presence record from sign-in to sign-out.
Continuous facial verification, 1 of 6
Who else is looking at the screen
The webcam watches the room as well as the user, so the two capture paths that leave no digital trace are caught as they happen.
A lens pointed at the display blanks the screen before the shot is useful.
A second face in frame blanks the screen and logs the event.
Tuned for open floors, shared offices and home desks.
The screen locks the moment the verified user leaves.
Phone camera detection, 1 of 4
Capture and export control
Screenshots and screen sharing are controlled at the session rather than inside each application, and every visible frame carries a mark that survives a photograph.
Enforced below the application layer.
Set per policy, per application and per session.
An invisible mark encoding user, time and IP.
Runs automatically once enabled, even if a user skips a policy step.
Screenshot and screen-capture blocking, 1 of 4
Evidence and traceability
A login record does not answer the question a regulator or a client asks: was an authorized human in front of that data the whole time?
Shows who was at the screen and when they were not.
Each attempt is attributed to a named user.
Streams into the tooling your SOC already watches.
Traces a leaked image to one user and one session.
Presence attestation, 1 of 4
Why it is different
Why CISOs add continuous authentication at the screen
Insider threat detection programs watch files and network traffic. Presence Authority covers the screen, and the person or phone in front of it, without adding a monitoring tool.
Not just another screen DLP
DLP and screen DRM each cover part of the screen. Neither answers who is sitting in front of it.
| Dimension | Typical DLP or screen DRM | Presence Authority |
|---|---|---|
| Identity | Checks the device or the file, not the person | Continuously verifies the person who authenticated, bound to IAM identity and MFA |
| Presence | Assumes the user is still there after login | Detects human presence and locks when the verified user leaves |
| Camera | Photo detection is partial or absent | Detects a lens pointed at the display and blanks the screen |
| Bystanders | No view of the room | A second face in frame blanks the screen and logs the event |
| Capture | Partial, often set inside each application | Screenshot and share control below the application layer |
| Evidence | A login record | A continuous presence record, streamed to SIEM, SOAR and XDR |
| Privacy | Varies by product | No frames stored, no productivity tracking |
| Coverage | Managed devices, often VDI only | One lightweight agent on contractor and unmanaged devices |
Category-level comparison based on representative vendors' public materials. Specific products vary.
Privacy by design
Built to pass the privacy review, not just the security review
A camera-based control fails on the works council call, not the technical one.
Photos and video are not stored
The face is kept as an encrypted numeric template on the laptop. Camera frames are never written to disk.
No biometric images at restData stays on the laptop by default
Verification runs on the device or on-premises. You choose whether reports leave the device, which eases biometric privacy and GDPR reviews.
On-device or on-premisesProductivity is not monitored
It records presence events and exfiltration attempts. It does not track applications, keystrokes or output.
Security events onlyCompliance
- GDPRCompliant
- SOC 2Type II
- ISO 27001Certified
Deploy your way
- Public SaaSFastest to start
- Private SaaSDedicated tenant
- On-premisesData never leaves
Integrations
Works with the tools you already run
Presence Authority plugs into the identity, security and device tools you already run.
Identity providers
Presence is bound to the identity your IdP already issues, whether that is SecureAuth, Okta, Ping Identity or Microsoft Entra ID.
SIEM, SOAR and XDR
Presence and detection events stream to your SOC in Splunk, CrowdStrike, Datadog, Microsoft Sentinel and more.
Deployment and device management
Roll the lightweight agent out with the tools that already manage your fleet, such as Jamf and Microsoft Intune.
Where screen leaks cost the most
Industries we protect
The access is valid, so existing controls see nothing. One leak can cost a deal, a patent or a product.
Financial services, BPO and contact centers
BPO and contact-center agents, often at outsourced sites, see customer records, card and account data all day.
Legal, LPO and virtual data rooms
Contract attorneys, LPO teams and outside reviewers read M&A files, patents and case strategy on devices you do not control.
Semiconductors and high‑tech manufacturing
Engineering contractors work in CAD, process documents and roadmaps. A few photos can hand over years of R&D.
Healthcare and RCM
Revenue cycle management (RCM) teams and staffing clinicians handle patient records and claims, often remotely.
Software and IT services
Offshore and contract developers see source code, architecture and credentials.
Government and defense
Subcontractors work with controlled and program data outside your own walls.
Frequently asked questions about Presence Authority
What is SecureAuth Presence Authority?
Presence Authority, formerly SessionGuardian, is a screen-level data loss prevention and continuous authentication control. It verifies that the person at the screen is the person who authenticated, for the whole session, and closes the paths data takes off a screen: screenshots, screen sharing, phone cameras, bystanders and unattended sessions.
What is SessionGuardian?
SessionGuardian is the former name of SecureAuth Presence Authority. It is now part of the SecureAuth Authority product family, alongside Workforce Authority and Agent Authority.
Was Presence Authority previously known as SessionGuardian?
Yes. Presence Authority was known as SessionGuardian before it joined the SecureAuth Authority product family.
How is this different from MFA or conditional access?
MFA and conditional access evaluate the credential, device and context at login. They cannot tell you whether the person who authenticated is still there ten minutes later, whether someone is reading over their shoulder or whether a phone is pointed at the display. Presence Authority answers those questions continuously and binds the answer to the same identity.
Does it record or store video of employees?
No. The face is stored as an encrypted numeric template on the endpoint and camera frames are never written to disk. It records presence events and exfiltration attempts, not application use, keystrokes or productivity.
Can it be defeated with a photo or a deepfake?
Liveness and depth checks run continuously and reject printed photos, replayed video and synthetic faces.
How does it stop someone photographing the screen with a phone?
The webcam detects a lens pointed at the display and blanks the screen before the shot is useful, then logs the attempt against the user's identity. Anything that is captured carries an invisible watermark encoding user, time and IP, so a leaked image traces back to one session.
Does it work on contractor and unmanaged devices?
Yes. One lightweight agent runs on them, with no VDI and no application changes. Most screen exposure sits with contact-center agents, contract reviewers and offshore engineers on devices you do not own.
Get started
See Presence Authority protect a live session
Protect your IP before it leaves the screen. In 30 minutes on a real laptop, watch it stop a phone camera, a bystander and a screenshot.