Employer monitoring software: what it typically collects, and what it cannot see

A monitoring agent got rolled out on one of my machines. Reading the documentation rather than the rumours changed what I worried about. General shapes, not legal advice, and it varies by product and jurisdiction.

What agents commonly collect

• Active application and window titles, with timestamps. Window titles are the underestimated one, because they often contain document names, subject lines and client names.
• Idle versus active time, usually from keyboard and mouse activity rather than content.
• Websites visited, when traffic goes through a company proxy or the browser is managed.
• Periodic screenshots, on some products, at an interval an administrator sets.
• Installed software inventory and, on managed machines, the ability to install more.

What an agent on one machine cannot see

• What happens on a different device on a different network. This is the entire answer and it is why device separation is the only thing that reliably matters.
• Traffic that never touches the managed machine or network.

The practical version

• One machine per role, never crossing, including for something that "will only take a second".
• Assume window titles are logged, which means naming things carefully.
• Personal accounts stay off the work machine entirely, because a managed browser profile can sync more than people expect.
• Read the acceptable-use policy you signed rather than guessing. The written policy usually constrains more than the software does, and it is the thing that actually gets enforced.