Session & Input Monitoring
Tools that capture what a visitor types, clicks and does on screen: session replay, keystroke capture, form-field interception and clipboard access.
The engine of the current wiretap wave.
Session replay reconstructs what a visitor does as it happens, and courts have treated that as contemporaneous interception. Keystroke capture is the most direct form of input interception and the clearest wiretap fact pattern.
Chat widgets count too. Many record the full conversation, including text typed before a visitor hits send, and route it through a third party. Unmasked fields can expose sensitive data.
Third-party transmission of input data
Example finding. Vendor names are withheld.
What CyRisk tracks.
Severity and placement are CyRisk defaults. Your team can elevate, downgrade or drop any risk to context-only, per account.
| RISK | DEFAULT SEVERITY | DEFAULT PLACEMENT |
|---|---|---|
| Third-party transmission of input data | Critical | Critical to Bind |
| User input monitoring and session analytics | High | May Affect Coverage |
| Real-time keystroke capture | High | May Affect Coverage |
| Form field capture prior to submission | High | May Affect Coverage |
| Clipboard monitoring | High | May Affect Coverage |
| Input monitoring prior to consent | High | May Affect Coverage |
A session-replay, keystroke-capture or chat tool is observed recording or transmitting visitor input to a third-party server.
Remove third-party keystroke capture, mask every form field, and gate session replay behind consent. If a tool is retained for a documented purpose, encrypt what it sends, restrict the vendor by contract and disclose it.
Verified by rescan. The fix shows on the next scan.
Ready-to-use language.
“Which session-replay or chat vendor is used, are form fields masked, and under what agreement?”
“Mask all form fields and gate session replay behind consent, or remove keystroke capture, verified by CyRisk rescan.”
Sublimit or higher retention. Weigh most heavily on login, health and financial pages.
Keep exploring.
Laws this exposure can trigger
Related exposure families
Is all session replay a problem?
Not equally. Exposure depends on whether fields are masked, whether it runs before consent and which pages it covers.
Do chat widgets count?
Yes. Many record the full conversation, including what a visitor types before sending, and pass it through a third party.
Why is keystroke capture so serious?
It’s the most direct form of input interception, which makes it the clearest wiretap fact pattern.
Find the session tools in your pipeline.
Send five past submissions you’ve already bound, conditioned or declined. We score them blind, then put our disposition next to the call you made.
Severity and placement shown are CyRisk defaults and can be tuned per account. A detected exposure indicates a fact pattern common to privacy litigation, not a confirmed violation. Litigation theories explain why a finding is tracked; they are not legal advice.