Incydr

Overview

Incydr (by Code42 / Mimecast) is a SaaS insider risk management and data loss prevention platform. It provides complete visibility into employee file movements across endpoints, cloud services, messaging apps, and web destinations without requiring complex block rules. Utilizing AI risk prioritization, Incydr correlates data, user, and destination context to detect file exposure, source code exfiltration, and unauthorized GenAI usage.

Founder story

Incydr was launched in 2020 by Code42, a Minneapolis cybersecurity firm founded in 2001 by Matthew Dornquast, Brian Bispala, and Mitch Coopet. Developed under CEO Joe Payne to address corporate data theft during remote workforce shifts, Code42 pivoted fully into insider threat management with Incydr before being acquired by Mimecast in 2024.

What it does

• • Monitors endpoint, cloud, and email file movements to track unsanctioned data exfiltration across modern work channels
• • Prioritizes insider threat severity automatically based on user risk profiles, file sensitivity, and untrusted destination indicators
• • Triggers automated containment workflows, microlearning training videos, or security analyst escalations
• • Detects shadow AI usage and source code exposure across public GenAI tools and code repositories.

Who it's for

• Enterprise Security Teams
• Chief Information Security Officers (CISOs)
• Security Operations Analysts
• IT Compliance Leaders

Why it works

• Agent-based and API cloud monitoring delivers complete file movement visibility without requiring brittle rule management
• Context-driven AI scoring distinguishes between everyday legitimate employee collaboration and high-risk data theft
• Integrates directly with microlearning tools like Instructor to educate employees in real time upon policy violations
• Reduces response latency by executing automated containment actions via SOAR platforms and automated workflows.

Growth strategies

• Channel partner distribution with security aggregators and major IT solutions integrators.
• Strategic acquisition by Mimecast to bundle insider risk tools with broader enterprise email security.
• Tech stack integrations with SIEM, SOAR, and IAM vendors such as Tines, Splunk, and Okta.
• High- intent cybersecurity content marketing focusing on insider threat statistics and data exposure reports.

Alternatives

• Proofpoint ITM
• Digital Guardian
• Forcepoint DLP
• DTEX Systems

Comparison overview

• Uses non-blocking background monitoring to prioritize file movement context over hard endpoint blocks.
• Employs microlearning corrections (via Instructor) to correct accidental risky behavior automatically.
• Connects natively with Mimecast's Human Risk Management suite for combined cloud, email, and endpoint threat coverage.