That's not true.

I've been working in software for almost 20 years and have never had spyware like this installed on my PCs. I've worked for companies with over 70k employees, down to start ups with fewer than 100. Both in office and remote.

I'm not saying it doesn't happen, but it's definitely not normal, and I would personally never work under those conditions.

It's not normal to do screen capture, but internet logging and email/chat discovery are almost universal in a large company. Most financial companies will have forensic agents and inspect random emails.

Also, security tools are getting more sophisticated. As legacy AV gets replaced by next-gen stuff, there will be more creepy shit. If you have a tool like Crowdstrike, most developers will do stuff will get them flagged as high-risk.

You don't need to go to third parties to obtain such surveillance software, microsoft has several solutions for this as well. Actually many large companies that are running windows are also using windows defender advanced threat protection (atp), not just b/c it's easy to deploy, but also b/c it isn't very noticeable by users.

It's questionable how much such tools actually improves security, most of it appears to be a power grab by someone in charge of security, usually there's no transparency, and even C*Os aren't aware of how much they are snooped on. For example (as atp does), recording of all commands including arguments, stored in a searchable database. Who does this benefit the most?

> It's questionable how much such tools actually improves security, most of it appears to be a power grab by someone in charge of security, usually there's no transparency, and even C*Os aren't aware of how much they are snooped on. For example (as atp does), recording of all commands including arguments, stored in a searchable database.

I would agree it's often a power play for would be corporate cyber-warriors.

But the tools are very effective for certain threat categories. The downside is that they require skilled operational security people to be used effectively, and may security organizations are mostly compliance focused and don't have the talent or framework to pivot the organization. It's similar to how underperforming IT organizations were/are aligned with the CFO -- many security orgs are aligned with counsel/risk.

As a contractor or a full time employee at the 70k people companies? Was it in the past 10 years? If you used a company provided computer, did you investigate what was running? Did you go beyond the typical process manager and look into the kernel modules list?

They often don't disclose explicitly that this stuff is running, because it rightfully creeps people out and the 'security' types don't want people to know.

Contractor here, I mainly work on mega-big corporations. I always check what run on my PC. I never use the work machines for anything personal. FFS I don't even use their guest wifi. I stick to my data plan. I have noticed the last few years that BlueCoat is on the rise. From some article a couple of months back I read that the company/Fund that owned BC also bought Sophos.

Speaking of wifi, I have seen it used to check when people come to work, go on break, etc... (tracking mobile phones).

I think the parent means that if you don't agree/sign the "you can spy on me" policies, they just don't hire you.