// S22 Watermark · Insider threat defense

The screen remembers
who's looking.

S22 Watermark layers a tamper-resistant identifier, name, IP, timestamp, employee ID, over every screen. Deter screen photography, prevent insider data leaks, and trace any captured image back to the exact session that took it.

https://internal.client.corp/finance/q4-projections.confidential
Q4 Internal Financial Projections, CONFIDENTIAL
ID-2041Acquisition target, Project Hawkrestricted$48.2M
ID-2042Layoff scenario · Q1 2026restricted·
ID-2043Vendor contract renewal, AWSinternal$2.1M
ID-2044Salary band review, leadershiprestricted·
ID-2045Insurance claim, incident #4427internal$320K
CoACME Corp UserJohn Carter ADjcarter@acme.local Time08:42 GMT 2026-06-01
CoACME Corp UserJohn Carter ADjcarter@acme.local Time08:42 GMT 2026-06-01
CoACME Corp UserJohn Carter ADjcarter@acme.local Time08:42 GMT 2026-06-01
CoACME Corp UserJohn Carter ADjcarter@acme.local Time08:42 GMT 2026-06-01
CoACME Corp UserJohn Carter ADjcarter@acme.local Time08:42 GMT 2026-06-01
CoACME Corp UserJohn Carter ADjcarter@acme.local Time08:42 GMT 2026-06-01
CoACME Corp UserJohn Carter ADjcarter@acme.local Time08:42 GMT 2026-06-01
CoACME Corp UserJohn Carter ADjcarter@acme.local Time08:42 GMT 2026-06-01
CoACME Corp UserJohn Carter ADjcarter@acme.local Time08:42 GMT 2026-06-01
CoACME Corp UserJohn Carter ADjcarter@acme.local Time08:42 GMT 2026-06-01
CoACME Corp UserJohn Carter ADjcarter@acme.local Time08:42 GMT 2026-06-01
CoACME Corp UserJohn Carter ADjcarter@acme.local Time08:42 GMT 2026-06-01
CoACME Corp UserJohn Carter ADjcarter@acme.local Time08:42 GMT 2026-06-01
CoACME Corp UserJohn Carter ADjcarter@acme.local Time08:42 GMT 2026-06-01
CoACME Corp UserJohn Carter ADjcarter@acme.local Time08:42 GMT 2026-06-01
CoACME Corp UserJohn Carter ADjcarter@acme.local Time08:42 GMT 2026-06-01
CoACME Corp UserJohn Carter ADjcarter@acme.local Time08:42 GMT 2026-06-01
CoACME Corp UserJohn Carter ADjcarter@acme.local Time08:42 GMT 2026-06-01
CoACME Corp UserJohn Carter ADjcarter@acme.local Time08:42 GMT 2026-06-01
CoACME Corp UserJohn Carter ADjcarter@acme.local Time08:42 GMT 2026-06-01
68%
of insider data breaches start with a screen capture or photo
/// Industry research
$4.9M
average cost of an insider-driven data breach
/// IBM 2024
73%
of remote workers admit to taking screenshots of company data
/// 2024 survey
0
DLP tools that can stop a phone camera pointed at a monitor
/// Until now
// The blind spot

Your DLP can't
see a phone camera.

Modern DLP, EDR, and CASB platforms can block clipboards, lock USB ports, and watermark documents at print time. None of them can stop an employee from pulling out a phone and photographing the screen.

S22 Watermark closes that gap. Every confidential session displays a low-opacity, tamper-resistant overlay that ties the visible content to a specific user, device, IP, and timestamp, making the act of capturing it self-incriminating.

// How it works

Three layers of deterrence

Lightweight agent. Centrally managed. Forensic-grade trace if a leak happens.

01

Deploy & identify

A <15MB endpoint agent (Windows/macOS/Linux) ties the active session to user identity from AD/Azure/Okta. Zero impact on performance.

02

Overlay & deter

A semi-transparent watermark renders above all content, name, employee ID, IP, hostname, timestamp. Tiled, rotated, low-opacity. Visible enough to deter, light enough not to disrupt.

03

Trace & respond

If a leaked image surfaces, decode the watermark to identify the exact user, device, and timestamp of capture. Forensic evidence in seconds, not weeks.

// Features

Built for enterprise security teams

Everything a CISO needs to deploy at scale and integrate with existing controls.

Tamper-resistant overlay

Renders at the OS compositor layer, can't be hidden by a window, dimmed by a screenshot tool, or stripped from a screen recording.

Identity-bound

Pulls user identity from Active Directory, Azure AD, Okta, or LDAP. Watermark tied to actual session, not a hostname.

Customizable display

Control opacity, rotation, density, color, and which fields appear (name, IP, ID, time, custom). Different policies per app or sensitivity tag.

Dark & Light adaptive

Watermark contrast adjusts automatically per app and per page. Stays readable on dark IDEs, light dashboards, and everything in between, including system theme switches.

App-aware policies

Trigger watermarks only when a specific app is in focus, CRM, finance system, source code editor, and stay silent everywhere else.

Forensic trace

Upload a leaked image. Our analyzer decodes the watermark even from a phone photo at angle, returning user, time, device, and IP.

Centralized console

Web admin to push policies, monitor agent health, manage exemptions, and review forensic queries, across thousands of endpoints.

// Cross-platform

Runs on every OS your team uses

Native agent for Windows, macOS and Linux. Watermark adapts automatically to dark and light interfaces, so it stays readable on any screen, in any app.

Auto-adapts to Light & Dark Mode
Windows 11
Light
S22 Watermark running on Windows 11
CoACME Corp UserJohn Carter ADjcarter@acme.local Time08:42 GMT 2026-06-01
CoACME Corp UserJohn Carter ADjcarter@acme.local Time08:42 GMT 2026-06-01
CoACME Corp UserJohn Carter ADjcarter@acme.local Time08:42 GMT 2026-06-01
CoACME Corp UserJohn Carter ADjcarter@acme.local Time08:42 GMT 2026-06-01
CoACME Corp UserJohn Carter ADjcarter@acme.local Time08:42 GMT 2026-06-01
CoACME Corp UserJohn Carter ADjcarter@acme.local Time08:42 GMT 2026-06-01
CoACME Corp UserJohn Carter ADjcarter@acme.local Time08:42 GMT 2026-06-01
CoACME Corp UserJohn Carter ADjcarter@acme.local Time08:42 GMT 2026-06-01
CoACME Corp UserJohn Carter ADjcarter@acme.local Time08:42 GMT 2026-06-01
CoACME Corp UserJohn Carter ADjcarter@acme.local Time08:42 GMT 2026-06-01
CoACME Corp UserJohn Carter ADjcarter@acme.local Time08:42 GMT 2026-06-01
CoACME Corp UserJohn Carter ADjcarter@acme.local Time08:42 GMT 2026-06-01
CoACME Corp UserJohn Carter ADjcarter@acme.local Time08:42 GMT 2026-06-01
CoACME Corp UserJohn Carter ADjcarter@acme.local Time08:42 GMT 2026-06-01
CoACME Corp UserJohn Carter ADjcarter@acme.local Time08:42 GMT 2026-06-01
CoACME Corp UserJohn Carter ADjcarter@acme.local Time08:42 GMT 2026-06-01
CoACME Corp UserJohn Carter ADjcarter@acme.local Time08:42 GMT 2026-06-01
CoACME Corp UserJohn Carter ADjcarter@acme.local Time08:42 GMT 2026-06-01
CoACME Corp UserJohn Carter ADjcarter@acme.local Time08:42 GMT 2026-06-01
CoACME Corp UserJohn Carter ADjcarter@acme.local Time08:42 GMT 2026-06-01
Windows 11Watermark stays readable on light Fluent backgrounds.
macOS
Light
S22 Watermark running on macOS
CoACME Corp UserJohn Carter ADjcarter@acme.local Time08:42 GMT 2026-06-01
CoACME Corp UserJohn Carter ADjcarter@acme.local Time08:42 GMT 2026-06-01
CoACME Corp UserJohn Carter ADjcarter@acme.local Time08:42 GMT 2026-06-01
CoACME Corp UserJohn Carter ADjcarter@acme.local Time08:42 GMT 2026-06-01
CoACME Corp UserJohn Carter ADjcarter@acme.local Time08:42 GMT 2026-06-01
CoACME Corp UserJohn Carter ADjcarter@acme.local Time08:42 GMT 2026-06-01
CoACME Corp UserJohn Carter ADjcarter@acme.local Time08:42 GMT 2026-06-01
CoACME Corp UserJohn Carter ADjcarter@acme.local Time08:42 GMT 2026-06-01
CoACME Corp UserJohn Carter ADjcarter@acme.local Time08:42 GMT 2026-06-01
CoACME Corp UserJohn Carter ADjcarter@acme.local Time08:42 GMT 2026-06-01
CoACME Corp UserJohn Carter ADjcarter@acme.local Time08:42 GMT 2026-06-01
CoACME Corp UserJohn Carter ADjcarter@acme.local Time08:42 GMT 2026-06-01
CoACME Corp UserJohn Carter ADjcarter@acme.local Time08:42 GMT 2026-06-01
CoACME Corp UserJohn Carter ADjcarter@acme.local Time08:42 GMT 2026-06-01
CoACME Corp UserJohn Carter ADjcarter@acme.local Time08:42 GMT 2026-06-01
CoACME Corp UserJohn Carter ADjcarter@acme.local Time08:42 GMT 2026-06-01
CoACME Corp UserJohn Carter ADjcarter@acme.local Time08:42 GMT 2026-06-01
CoACME Corp UserJohn Carter ADjcarter@acme.local Time08:42 GMT 2026-06-01
CoACME Corp UserJohn Carter ADjcarter@acme.local Time08:42 GMT 2026-06-01
CoACME Corp UserJohn Carter ADjcarter@acme.local Time08:42 GMT 2026-06-01
macOSCompositor-level overlay - works in System Settings, Finder, every app.
Ubuntu Linux
Dark
S22 Watermark running on Ubuntu Linux
CoACME Corp UserJohn Carter ADjcarter@acme.local Time08:42 GMT 2026-06-01
CoACME Corp UserJohn Carter ADjcarter@acme.local Time08:42 GMT 2026-06-01
CoACME Corp UserJohn Carter ADjcarter@acme.local Time08:42 GMT 2026-06-01
CoACME Corp UserJohn Carter ADjcarter@acme.local Time08:42 GMT 2026-06-01
CoACME Corp UserJohn Carter ADjcarter@acme.local Time08:42 GMT 2026-06-01
CoACME Corp UserJohn Carter ADjcarter@acme.local Time08:42 GMT 2026-06-01
CoACME Corp UserJohn Carter ADjcarter@acme.local Time08:42 GMT 2026-06-01
CoACME Corp UserJohn Carter ADjcarter@acme.local Time08:42 GMT 2026-06-01
CoACME Corp UserJohn Carter ADjcarter@acme.local Time08:42 GMT 2026-06-01
CoACME Corp UserJohn Carter ADjcarter@acme.local Time08:42 GMT 2026-06-01
CoACME Corp UserJohn Carter ADjcarter@acme.local Time08:42 GMT 2026-06-01
CoACME Corp UserJohn Carter ADjcarter@acme.local Time08:42 GMT 2026-06-01
CoACME Corp UserJohn Carter ADjcarter@acme.local Time08:42 GMT 2026-06-01
CoACME Corp UserJohn Carter ADjcarter@acme.local Time08:42 GMT 2026-06-01
CoACME Corp UserJohn Carter ADjcarter@acme.local Time08:42 GMT 2026-06-01
CoACME Corp UserJohn Carter ADjcarter@acme.local Time08:42 GMT 2026-06-01
CoACME Corp UserJohn Carter ADjcarter@acme.local Time08:42 GMT 2026-06-01
CoACME Corp UserJohn Carter ADjcarter@acme.local Time08:42 GMT 2026-06-01
CoACME Corp UserJohn Carter ADjcarter@acme.local Time08:42 GMT 2026-06-01
CoACME Corp UserJohn Carter ADjcarter@acme.local Time08:42 GMT 2026-06-01
Ubuntu LinuxRenders cleanly on dark desktops without losing legibility.
Without S22 Watermark

A leaked photo. No way to identify the source. Investigation = weeks of interviews and HR escalation.

With S22 Watermark
CoACME Corp UserJohn Carter ADjcarter@acme.local Time08:42 GMT 2026-06-01
CoACME Corp UserJohn Carter ADjcarter@acme.local Time08:42 GMT 2026-06-01
CoACME Corp UserJohn Carter ADjcarter@acme.local Time08:42 GMT 2026-06-01
CoACME Corp UserJohn Carter ADjcarter@acme.local Time08:42 GMT 2026-06-01
CoACME Corp UserJohn Carter ADjcarter@acme.local Time08:42 GMT 2026-06-01
CoACME Corp UserJohn Carter ADjcarter@acme.local Time08:42 GMT 2026-06-01
CoACME Corp UserJohn Carter ADjcarter@acme.local Time08:42 GMT 2026-06-01
CoACME Corp UserJohn Carter ADjcarter@acme.local Time08:42 GMT 2026-06-01
CoACME Corp UserJohn Carter ADjcarter@acme.local Time08:42 GMT 2026-06-01
// Forensic trace company=ACME Corp · user=John Carter · ad=jcarter@acme.local · login=08:42 GMT · date=2026-06-01

Same photo. Watermark identifies the exact session in seconds. Insider deterred, and traceable if it happens.

// Let's stop the leak

See S22 Watermark
protect your screens.

15-minute live demo. We'll show you the agent, the console, and the forensic decoder, using your actual environment as the example.