Behavox Falcon
Behavox Falcon is a human risk intelligence product designed to identify signals that may precede insider incidents.
What Behavox Falcon is
Behavox Falcon is a human risk intelligence product designed to identify signals that may precede insider incidents. It analyzes more than 150 communication data types against 18 risk policies, 17 AI-powered and one rule-based. Its indicators include realized risks such as data exfiltration and credential sharing, as well as predictive signals such as financial distress and disgruntlement. When signals overlap for an individual, Falcon can register the employee on a watchlist and share a risk profile with security, HR, legal, and compliance teams. Possible interventions include notifying a manager, revoking access, or involving HR or legal; on the Behavox platform, controls can also block sensitive transfers, quarantine attachments, or hold messages for review. Falcon can run as an API overlay on existing infrastructure or on the Behavox platform, which uses Quantum for aggregation, archiving, and surveillance. The full-platform option is described as single-tenant on GCP or AWS, with customer-held KMS keys and support for 50+ languages. Pricing is on request. The company says alerts are explainable and human-reviewed, and that Falcon does not make employment decisions on its own.
Good
- Analyzes 150+ communication data types.
- Covers realized and predictive risk indicators.
- Supports API overlay or Behavox platform deployment.
- Alerts are described as explainable and human-reviewed.
Watch out
- Pricing is available on request.
- Some intervention controls require the Behavox platform.
- API overlay sends extracted sentences for evaluation.
Who it suits
Falcon is aimed at organizations managing insider risk, including those in financial services, technology, healthcare, energy, government, defense, and legal sectors. It suits teams coordinating security, HR, legal, and compliance responses to risk signals.
Verdict
Falcon links communication signals to watchlists, risk profiles, and intervention workflows, with deployment options for existing infrastructure or the Behavox platform. Organizations should assess its configurable monitoring scope and governance needs before pursuing commercial terms.
Plans and prices
From Behavox Falcon's own pricing page, checked 3 Oct 2026.
| Plan | Price | What it gives you |
|---|---|---|
| Behavox Falcon | Priced on request | Commercial options discussed with sales |
The facts
Each one read from Behavox Falcon's own pages, with the date it was checked.
What it does
- Cloud and languages
- The full-platform deployment is described as single-tenant on GCP or AWS, with customer-held KMS keys and support for 50+ languages.checked 2 Oct 2026
- Deployment
- Falcon is offered as an API overlay or on the Behavox platform, where it runs on Quantum; full-platform deployments are described as single-tenant on GCP or AWS.checked 3 Oct 2026
- Detection
- Falcon runs 18 risk policies, 17 AI-powered and one rule-based, across 150+ communication data types.checked 3 Oct 2026
- Governance
- The product page says monitoring scope, indicators, and thresholds can be configured for an organization's lawful basis and jurisdiction, with role-based, least-privilege access to risk profiles.checked 2 Oct 2026
- Human oversight
- Falcon describes its alerts as explainable and human-reviewed, and says it does not make employment decisions on its own.checked 2 Oct 2026
- Indicators
- The product covers realized indicators such as data exfiltration and credential sharing, and predictive indicators such as financial distress and disgruntlement.checked 3 Oct 2026
- Integrations
- Falcon's API overlay can evaluate alert candidates from Global Relay, Smarsh, Relativity, and Bloomberg Vault, and its DataLabs API can connect insights to SIEM, data-visualization, and case-management systems.checked 3 Oct 2026
- Intended customers
- The maker describes Falcon as deployed across financial services, technology, healthcare, energy, government, defense, and legal sectors.checked 3 Oct 2026
- Intended users
- Behavox says Falcon is deployed across financial services, technology, healthcare, energy, government, defense, and legal sectors.checked 2 Oct 2026
- Intervention
- The product describes manager notification, access revocation, and HR or legal engagement as early intervention options based on watchlist status.checked 3 Oct 2026
- Investigation
- When multiple signals overlap for an individual, Falcon can register that employee on a watchlist and share a risk profile with security, HR, legal, and compliance teams.checked 2 Oct 2026
- Languages
- The Falcon page states that the full Behavox platform supports 50+ languages.checked 3 Oct 2026
- Privacy
- The API overlay sends extracted sentences for evaluation and the page states that no metadata or personally identifiable information is sent in transit.checked 2 Oct 2026
- Privacy controls
- Falcon supports configurable monitoring scope and thresholds, role-based least-privilege access, explainable alerts, and human review; the maker says it does not make employment decisions on its own.checked 3 Oct 2026
- Purpose
- Falcon detects human and behavioral signals that may precede insider incidents so organizations can intervene early.checked 3 Oct 2026
- Risk indicators
- The product detects realized indicators such as data exfiltration and credential sharing, and predictive indicators such as financial distress and disgruntlement.checked 2 Oct 2026
- Risk profiles
- When multiple signals overlap for an employee, Falcon can register that employee on a watchlist and share the risk profile with security, HR, legal, and compliance teams.checked 3 Oct 2026
- Security
- Behavox's security page states SOC 2 Type II, single-tenant GCP, and customer-held KMS keys.checked 3 Oct 2026
- Support
- Behavox offers a managed-services option in which its insider-threat specialists review alerts, curate watchlists, and escalate confirmed risks to the client.checked 2 Oct 2026
- Support option
- Behavox offers a managed-services option in which its insider-threat specialists review alerts, curate watchlists, and escalate true positives to clients.checked 3 Oct 2026
The company
- Company
- Behavox says it was founded in 2014 and lists London as its global headquarters.checked 2 Oct 2026
- Founded
- 2014checked 28 Sep 2026
- Headquarters
- London, United Kingdomchecked 28 Sep 2026
Alternatives to Behavox Falcon
- 1
Jatheon Cloud
AndroidiOSWebAPI7.5From $60 a month - 2
Microsoft Defender for Business
AndroidiOSAPImacOS7.5 - 36.7From $5,000 a year
- 4
NICE Actimize
WebAPI6.2 - 56.1
- 6
Global Relay Archive
WebAPI5.7