Faster Leak Investigations: Russian Platform SprutMonitor Gets Its Own AI Engine
Russian developer Kolibri LLC, which builds solutions for workforce performance monitoring and data leak prevention, has unveiled a major update to its SprutMonitor platform. The update introduces a proprietary AI engine for semantic analysis and behavioral analytics.
The development team has moved away from external cloud APIs (application programming interfaces), which allow applications and services to communicate over networks through cloud platforms. Data is now processed in an isolated environment using the company’s own fine-tuned model, built on the open Qwen 2.5 architecture. Users of SprutMonitor’s cloud version can already try out the new AI-powered system.
Understands Conversations in Two Languages
The developers had good reason to switch to their own model. Previously, SprutMonitor relied on external AI services to analyze meaning and interpret conversational context for enterprise data leak prevention. Those services handled the core tasks, but they came with drawbacks: dependence on third-party infrastructure, potential delays when processing large volumes of data, and limited ability to tailor a general-purpose model to the specific patterns of insider threats. With the move to a proprietary model, the situation has changed: threat analysis now takes place entirely within the SprutMonitor ecosystem.
The AI engine analyzes conversations in corporate email and messaging apps, monitors file operations and cloud storage, examines clipboard contents and search queries, and tracks application activity and work hours. The team chose Qwen 2.5 as its foundation because it performed well in both Russian and English and can handle long contexts of up to 128K tokens.
The model underwent specialized fine-tuning using examples drawn from SprutMonitor’s actual use cases. These included a database of information security incidents featuring unauthorized exports of customer databases, snippets of source code, and transfers of confidential documents. The training also covered HR and operational risks, including signs of burnout, job searches during work hours, sabotage, preparations to leave a company, and hidden workplace conflicts. The model was further trained to recognize corporate slang and informal communication styles, helping minimize false positives.
Saving the Security Team Time
According to the developers, the new AI engine analyzes end-to-end activity patterns and conversational context. Rather than relying on conventional keyword and phrase searches, it evaluates entire conversations and message threads instead of isolated messages. This makes it possible to detect situations in which employees discuss preparing to leak a database, even when the conversation is spread across different channels in fragments.
The platform also uses AI to filter false alarms, automatically distinguishing legitimate work activities – such as sending reports to business partners or sharing files – from anomalous behavior. Another feature automatically summarizes incidents. Instead of reading hundreds of messages, an information security analyst receives a concise report explaining who sent what information, to whom, and through which channel. The summary also includes an estimated probability of a policy violation.
Another advantage of the new AI engine is that it adds no workload to employee workstations. The neural network processes data asynchronously on the server side, leaving the performance of data-capture modules on users’ PCs unaffected.
The updated AI system is now enabled for users of the cloud version of SprutMonitor’s data loss prevention (DLP) platform, accessible through the “Risks” section of the web console. Testing of the on-premises edition is in its final stages, and that version is expected to become available soon. It is expected to allow companies to deploy the neural network on their own infrastructure, keeping confidential data fully isolated within their protected corporate perimeter.
Balancing Oversight and Protection
Adding a proprietary AI engine to SprutMonitor expands the platform’s capabilities for businesses. Ready-made incident summaries can cut investigation times from several hours to just a few minutes. By filtering false positives, the system helps security teams avoid getting bogged down in routine work or wasting time on cases that do not warrant further investigation. Predictive analysis can also help identify potential leaks and flag the risk of key employees leaving before a company suffers serious damage. For Russia’s IT market, products like this offer a practical example of how language models can be adapted to real-world information security challenges.
At the national level, the next stage in SprutMonitor’s development could strengthen oversight of sensitive data and reduce the time needed to investigate incidents. It could also improve protection for personal data, financial information, and documents held by employers, banks, service providers, and government organizations.
By incorporating a language model into its threat detection processes, the SprutMonitor team could help advance three areas of work for IT professionals in Russia. Security teams may gradually move beyond detecting violations toward predicting risks. Neural networks could also be deployed within corporate infrastructure, a particularly important option for organizations unwilling to share sensitive data with external providers. In addition, companies could gain stronger oversight of how employees use generative AI.
