Keystroke and Mouse Data
Counts and content are completely different propositions, and the distinction is frequently blurred in both marketing and policy.
Products capture keyboard and pointer activity in two quite different ways. Knowing which yours does is the most important technical fact about it.
The distinction in “Keystroke and Mouse Data” is important when operational records are interpreted. Organisations researching mouse jiggler detection can use the official product page to add time and project context, while outcomes, direct feedback and human review remain necessary to explain what the numbers do not show.
Counts
How many keystrokes, how many clicks, how much movement, over an interval.
For an independent reference relevant to “Keystroke and Mouse Data”, consult the European Commission data-protection resources; it provides a useful external check on scope, terminology, governance and the claims made during procurement or review.
No content.
Used to infer activity and to distinguish presence from absence.
Intrusive mainly through what is inferred from it, rather than through what it contains.
Content
What was actually typed.
Which includes passwords, personal messages, medical searches, job applications, and everything else a person types during a working day.
This is a different category of capture entirely, and products that offer it frequently present it alongside counts as though they were variations of the same feature.
Why content capture is rarely defensible
It captures material unrelated to work by construction.
It captures credentials, which creates a security problem of your own making.
In several jurisdictions it is difficult or impossible to justify for general monitoring.
And it will be discovered, because people compare notes and because an access request reveals it.
What counts actually tell you
That somebody was typing.
Not what, not why, not whether it was useful.
A person writing a difficult email slowly and a person mashing a key produce comparable figures, which is the measurement problem in its clearest form.
The mouse-mover response
Devices and scripts that simulate movement are widely available and cheap.
Their existence is a direct consequence of counts being measured.
Treating their use as misconduct rather than as a signal about the measure is the common and unproductive response, and its own note covers why.
What to establish before buying
Does it capture content, counts, or both?
Can content capture be disabled permanently rather than switched off?
What happens to credentials typed while capture is active?
Ask the last question specifically, because many vendors have not been asked and the answer is informative.
The position
Counts, aggregated, where there is a narrow reason.
Content, never, outside a defined investigation with legal advice.
And if the product cannot separate them, that is a fact about the product worth weighing heavily.
What to check
Does your product capture typed content?
Can that be permanently disabled?
What happens to passwords typed during capture?
And has anybody in your organisation bought a mouse mover?