How to Tell If You Are Being Monitored at Work: 8 Checks

To tell if you are being monitored at work, check five places on the work laptop. First read the IT policy, which often names the tool. Then check whether the laptop is managed and look for a monitoring agent in the running processes. Next open chrome://management or edge://management to see if the browser reports to the company. Last, click the padlock on any site and check who issued the certificate. A company name there, or Zscaler or Netskope, means the company decrypts your web traffic. None of these checks proves there is no monitoring, because stealth agents can hide. Assume a company laptop is watched, and ask IT in writing when it matters.

The overview of every monitoring layer is in how do employers monitor remote workers.

Eight signs you are being monitored at work

Checks 1, 2 and 8 come back yes on almost every company laptop. They mean monitoring is possible. Checks 3, 4 and 6 are the ones that show active watching.

What the checks look like on a Mac with no monitoring

To show what a clean result looks like, we ran checks 2, 3, 6 and 7 on a personal Mac (macOS 26.5.2) on October 4, 2026:

$ profiles status -type enrollment
Enrolled via DEP: No
MDM enrollment: No

$ launchctl list | grep -iE 'activtrak|teramind|hubstaff|timedoctor|insightful|veriato'
(no output, exit code 1: none of these names is running)

$ systemextensionsctl list
2 extension(s)
...  org.pqrs.Karabiner-DriverKit-VirtualHIDDevice   [activated enabled]
...  io.tailscale.ipn.macsys.network-extension      [activated enabled]

$ echo | openssl s_client -connect www.google.com:443 -servername www.google.com 2>/dev/null | openssl x509 -noout -issuer
issuer=C=US, O=Google Trust Services, CN=WR2

$ scutil --proxy
(only the exceptions list: *.local, 169.254/16, localhost; no HTTPProxy or HTTPSProxy line)

Each line reads as a "no": the Mac is not enrolled in MDM, no known agent is running, the two system extensions are a keyboard remapper and a personal VPN that we installed ourselves, Google's certificate comes from Google's own authority, and no proxy is set. On a monitored work laptop you would expect MDM enrollment: Yes, an agent or security extension you did not install, and possibly your company's name as the certificate issuer. The systemextensionsctl list is worth reading line by line, because a monitoring or web-filtering product that inspects traffic on a Mac usually runs as a network extension there.

Check 1: read the IT policy

The acceptable use policy or the employee handbook often names the monitoring or data loss prevention tool, because disclosure protects the employer. In New York, Connecticut and Delaware, employers must give written notice of electronic monitoring. In the EU and UK, monitoring has to be disclosed under data protection law. If the policy says "all activity on company devices may be monitored", treat that as a yes.

Check 2: is the laptop managed?

On Windows, open Command Prompt and run:

dsregcmd /status

AzureAdJoined : YES and an MdmUrl line mean the laptop is joined to your company's Microsoft Entra ID and enrolled in device management such as Intune. On a Mac, open Terminal and run:

profiles status -type enrollment

MDM enrollment: Yes means the company manages the Mac. Management alone does not watch you. It lets IT push any software, including a monitoring agent, without asking you.

Check 3: look for a monitoring agent

On Windows, open PowerShell and search running processes and installed apps for the common names:

# no output means none of these names are running or installed
$names = 'activtrak|teramind|hubstaff|timedoctor|insightful|veriato|controlio|currentware|kickidler|interguard'
Get-Process | Where-Object { $_.ProcessName -match $names } | Select-Object ProcessName, Path
Get-ItemProperty 'HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*', 'HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*' |
  Where-Object { $_.DisplayName -match $names } | Select-Object DisplayName, Publisher

On a Mac, list background items and system extensions:

# look for names you do not recognize, not only the ones in the grep
launchctl list | grep -iE 'activtrak|teramind|hubstaff|timedoctor|insightful|veriato'
systemextensionsctl list

Security tools such as CrowdStrike, SentinelOne or Microsoft Defender will show up too. They watch for malware and can log processes and connections, but they do not take screenshots of your work. Look them up before you worry.

Check 4: which apps can see your screen and input

On a Mac, open System Settings, then Privacy & Security. Check three lists: Screen & System Audio Recording, Accessibility and Input Monitoring. A monitoring agent needs at least one of them to capture the screen or keystrokes, so it appears there by name. Company software can grant these through MDM, and then you cannot turn them off. Which monitoring tools record the keys you press and which only count activity is in can my employer see my keystrokes.

Windows has no single list like this. Check 3 is the Windows equivalent. A camera light that turns on when no call is running is a separate sign, covered in can my employer see me through my laptop camera.

On a Mac, the full set of checks, with the permissions IT can pre-approve and a script that runs them in one go, is in how to check if your work Mac is being monitored.

Check 5: is your browser managed?

Type chrome://management in Chrome or edge://management in Edge. If it says "Your browser is managed by your organization", the page lists what the company controls. Look for extensions installed by policy and for reporting of browsing data. A managed browser with reporting sends your history even when the laptop has no monitoring agent. What the company sees in history is in can my employer see my browsing history.

Checks 6 and 7: the network

Click the padlock on any HTTPS site, open the certificate, and read the issuer. On a Mac or Linux you can read it in Terminal with the openssl line shown above. A public authority such as DigiCert, Let's Encrypt, Sectigo or Google Trust Services is normal. Your company's name, or a product such as Zscaler, Netskope or Palo Alto Networks, means the company opens and inspects encrypted traffic. It can then see full page addresses and form contents, not only site names. That includes personal webmail read in the work browser; see can my employer see my personal email on my work computer.

To see whether traffic goes through a company proxy, run this on Windows:

netsh winhttp show proxy

And this on a Mac:

scutil --proxy

A proxy server address, or a VPN that reconnects by itself and cannot be turned off, means every site you visit passes through a company server.

Check 8: the work apps log by design

Slack, Teams, Google Workspace and Microsoft 365 keep your messages and files, and admins can export them on some plans. They do not see your screen or other apps. Slack shows only an active or away dot built from the computer's idle time. The Slack details are in can Slack be used to monitor employees. Teams also reports activity counts, as in does Teams track your activity.

Even with no monitoring agent, a work computer logs every sign-in, lock and unlock. What those records hold and who reads them is in can my employer see when I log into my computer.

What these checks cannot tell you

• • Stealth agents. Several monitoring products offer a hidden mode with harmless process names. An empty search is not proof.
• • Server-side logs. Email, file shares and cloud apps are logged on the company's servers, where no check on your laptop can see them.
• • Your phone. A personal phone without a work profile is outside all of this. A work profile or a company phone is not, as in can my employer see what I do on my phone.

The safe rule: keep personal browsing, banking and chats on a personal device. Tools that fake activity are visible too. A mouse jiggler shows up in agents that log input, as in can a mouse jiggler be detected.

FAQ

Can employees tell if they are being monitored?

Sometimes. A tray icon, an agent in the process list or a policy notice gives it away. Stealth monitoring is built to leave no visible sign, so the policy and a direct question to IT are more reliable than any check.

Is there a bossware detection tool?

No tool catches every product. Antivirus scanners flag some monitoring agents as potentially unwanted, but on a company laptop the company controls the antivirus too. The manual checks above cover the common products.

Can my employer see my screen?

Only if monitoring software takes screenshots or records, or during a screen share or remote support session. The full answer is in can my employer see my screen.

Is my employer monitoring my personal computer?

Not unless company software is on it. Signing in to Slack or Outlook on a personal computer lets those apps see only their own activity. The full breakdown is in can my employer monitor my personal computer.

What is bossware?

A common name for employee monitoring software that records apps, sites, idle time and often screenshots. Examples and what each records are in what is bossware.