Excavate vs DTEX.
DTEX is a platform your team runs, built around a forwarder on your endpoints. Excavate’s coverage installs nothing, and we do the investigating as a service.
Last checked 14 October 2026 · Sources below
DTEX puts a lightweight forwarder on your endpoints, keeps a risk score for every user, and your analysts work its findings, with AI agents and i3 analysts as add-ons. Excavate installs nothing for coverage: it reads the systems you already run, our AI agent and examiners work every trigger, every departure gets an exit review, and every case ends in a conclusion signed by the examiner.
Where Excavate
is stronger.
What you get with Excavate that DTEX leaves to your analysts or to add-ons.
Our AI agent and examiners work every trigger. With DTEX, your analysts work the findings, and i3 tiers add managed threat hunts and 6 or 12 investigations a year, or a dedicated analyst.12
Excavate reads the systems you already run through read-only APIs. DTEX runs a forwarder on your endpoints.3
An exit review for every departure, opened from your HR system. We ask IT to hold the laptop until it closes. DTEX can raise monitoring of leavers and feed HR data into their risk score.45
Every case ends in a written conclusion signed by the examiner. DTEX gives your analysts scores, alerts and reports, and its i3 investigations end in a written report.32
The record is backfilled when you connect and kept until you delete it. DTEX’s published standard cloud specification keeps 60 days searchable and 120 days in backup, extendable to five years.67
Excavate does not score or rank people. DTEX keeps a risk score for every user.8
Side by side.
| Excavate | DTEX | |
|---|---|---|
| Who investigates | Our AI agent and examiners. Only an examiner escalates or concludes against a person. | Your analysts. i3 tiers add managed threat hunts and 6 or 12 investigations a year, or a dedicated analyst.12 |
| What you hold at the end | A written conclusion, signed by the examiner. | Scores, alerts and reports. i3 investigations end in a written report.32 |
| Departing employees | An exit review for every departure, opened from your HR system during offboarding. | DTEX can raise monitoring of leavers. HR data can feed the risk score.45 |
| History | Backfilled from each source. Nothing expires until you delete it. | Standard cloud: 60 days searchable, 120 in backup. Extendable to 365 days or five years.67 |
| People | No scoring or ranking of people. | A risk score for every user.8 |
| What you buy | A service. We keep the record and investigate. | A platform your team runs, with optional AI agents and analysts.372 |
| Sees activity on the device | Only when a laptop is collected on a case. | Yes, around the clock, through a forwarder on your endpoints.3 |
| When data leaves | We warn you through detections and investigate what happened. | Risk-Adaptive DLP can warn or block on the endpoint.9 |
How DTEX works.
From DTEX’s own public documentation, as of 14 October 2026.
A lightweight forwarder on your endpoints records activity around the clock, on and off the network.3 It runs on Windows, macOS, Linux and servers.10
DTEX also collects data from Microsoft 365 and Google Workspace.5
DTEX keeps “a risk score for every user and activity” and maps behavior to malicious, non-malicious or compromised intent.83
Your analysts work the findings. DTEX’s AI agents, sold as an add-on, triage alerts and pass them to those analysts.117 Its i3 analysts can also work for you: tiers include managed threat hunts and 6 or 12 investigations a year, each ending in a written report, and DTEX also offers a dedicated analyst.12
Risk-Adaptive DLP can warn or block data leaving the endpoint, tightening as a user’s risk rises. It also classifies content by inspecting it on the device.9
DTEX markets a leavers and joiners use case.12 Monitoring can increase automatically for leavers4, and HR data on leavers can feed the risk score.5
Running both.
If you already run DTEX, keep it: it sees the device and can block. Excavate connects read-only to the systems you already run, reviews every departure in writing, and does the investigating. Coverage installs nothing on the laptops.
Questions buyers ask.
We already run DTEX. Why add Excavate?+
If your team has the hours to work DTEX’s findings, you may not need to. If it does not, Excavate does the investigating and reviews every departure in writing, and its coverage installs nothing on the laptops.
Does Excavate see what DTEX sees on the laptop?+
Not continuously. Excavate’s coverage installs nothing. Device evidence comes from the laptop when your IT runs our collection tool on a case.
How do the investigations compare?+
DTEX’s i3 investigations are scoped by your team and end in a written report.2 Some tiers include 6 or 12 a year.1 At Excavate our AI agent and examiners work every trigger, every departure gets an exit review, and investigations run within an annual allowance. Each ends in a written conclusion signed by the examiner.
What does our team still do?+
Grant read-only access, ask IT to hold a leaver’s laptop, run our collection tool when a case needs it, and decide what to do with each conclusion.
- AWS Marketplace: DTEX i3 services
- DTEX: i3 subscription models, and the guide linked there
- DTEX: The DTEX Platform
- DTEX: User activity monitoring solution brief (2026), and the PDF linked there
- DTEX: Integrations, and the integrations guide linked there
- DTEX: Support policy
- DTEX: CNSSD 504 requirements mapping
- DTEX: Insider Risk Management solution brief
- DTEX: Risk-Adaptive DLP, and the solution brief linked there
- DTEX: Global bank case study (Sep 2026)
- DTEX: Triage Guardian
- DTEX: Leavers and joiners
- DTEX: Data privacy and protection, and the paper linked there
- DTEX: Privacy
DTEX and DTEX InTERCEPT are trademarks of DTEX Systems. Excavate is not affiliated with or endorsed by any company named on this page. If something here is out of date, write to info@excavate.ai and we will correct it.
See it on your own systems.
Thirty minutes on the systems you run, and what Excavate would do with them.
All comparisons →