Articles in this section

Detect Mouse Jigglers and Other Activity Mimicking Tools

ActivTrak Product Team
published
updated

ActivTrak's workforce analytics platform helps organizations optimize productivity and performance through data-driven insights. Our activity detection capabilities ensure your productivity analytics stay accurate by identifying potential artificial inputs that could skew your data.

ActivTrak employs three detection methods — pattern recognition, software identification, and duration analysis — to identify activities that require closer examination. When the system flags these activities, you can investigate and decide what's legitimate, giving you confidence in your data quality.

Contents

Why Potential False Activity (PFA) detection exists

ActivTrak's PFA detection is built on two core observations:

  1. Exceptionally few roles outside IT and engineering would require a mouse-mimicking tool to prevent a computer from entering a passive state.
  2. Based on years of analysis across thousands of companies and roles, it is highly unlikely that someone can remain continuously active at their device — without switching screens or going passive — for more than 30 minutes.

These principles inform the thresholds and alarm defaults used throughout PFA detection. When you see a flag, it means ActivTrak has observed something inconsistent with normal human-computer behavior.

ActivTrak Academy

Learn how to configure Potential False Activity alarms, investigate alerts, and measure impact over time. The Detecting False Activity certification covers the full workflow from setup to action. Start learning →

Understanding PFA detection capabilities

ActivTrak offers a comprehensive three-tiered approach to detecting and mitigating activity simulation:

  1. Software detection identifies known mouse-jiggling applications running as a process on the device's operating system. Detection is immediate — ActivTrak does not need to observe behavior over time. Time measurement is not affected by this alarm; it is only a notification.

 

  1. Pattern recognition detects uniform, repetitive input patterns — hardware or software-based — that don't resemble normal human behavior. When detected, ActivTrak immediately reclassifies the activity. What happens next depends on your Agent version — see both scenarios below. Once PFA detection ends, activity reporting will resume normal operations.

 

  1. Duration analysis flags when someone spends more than 45 minutes on a single screen without switching tabs or going passive. The 45-minute default is based on analysis across more than 9,500 accounts. Time measurement is not affected by this alarm; it is only a notification.

 

Each of these is key to determining whether an employee may be using a device or software to appear active when they're not. No other solution on the market offers this multi-layered approach.

Confidence levels and when to act

Not all PFA alarms carry equal certainty. Use the guidance below to understand how confident you can be in a single event — and how that confidence grows when patterns persist over time. We will take a deep look at each alarm type in the next section.

Isolated event confidence

Detection type Confidence Rationale
Software 100% Based on a continuously growing, crowd-sourced database of known mouse-jiggling software.
Repetitive pattern 80% Identifies "robotic" behavior such as precisely timed inputs or unusually fast, sustained keyboard/mouse activity.
High duration 70% Based on activity analysis across thousands of users — staying continuously active for 30+ minutes without switching screens is highly atypical.

7+ day timeframe confidence

When alarms occur repeatedly, averaging greater than two instances a day over a week or more, confidence increases significantly:

Pattern (averaging >2 incidents/day) Confidence
Multiple instances of both Repetitive Pattern + High Duration 95%
Multiple instances of Repetitive Pattern 90%
Multiple instances of High Duration 80%

Tip: Enabling screenshots for High Duration and Repetitive Pattern alarms significantly increases the evidence available for confident action. See the ActivTrak Alarms Overview for more information.

Out-of-the-box Alarms to detect potential false activity

Every ActivTrak account includes three pre-configured alarms that help spot potential false activity (PFA). They're turned off by default, so you'll need to activate them using the toggle on the Alarm Configuration page via Notifications > Compliance Alarms > Alarm Configuration.

  1. PFA: Input Stimulation Software: Get immediate alerts when mouse jigglers or similar activity-simulating software are detected running on a device.
  2. PFA: Repetitive Activity: Get notified when the system spots repetitive patterns that don't look like normal human behavior. When detected, ActivTrak immediately reclassifies that activity to keep your reports accurate. You can configure the alarm to stop monitoring after a set period (default 60 minutes, adjustable in settings). Available on Windows devices only.
  3. PFA: High Duration Activity: Get alerts when someone spends more than 45 minutes on a single screen. You can adjust this timeframe in the alarm settings.

Since new activity-mimicking tools pop up regularly, using all three alarms gives you the best coverage for catching different methods people might use to fake productivity.

Input Simulation Software 

This Alarm flags when someone might be using a mouse jiggler or other software that simulates activity. It catches most simulation software and rarely triggers false alerts, as ActivTrak can identify these programs directly on the computer's operating system.

This is a zero-duration event — it won't show a duration in the Alarm Log. After the first alarm triggers for a user, repeat notifications pause for 12 hours to prevent alarm fatigue.

Keep in mind: this alarm detects when the software is running as a process on the device, not necessarily when it is actively simulating input. Think of it like a recording app being open but not actively recording — the presence of the running process is flagged, but it does not confirm the software was in active use at that moment. It works with ActivTrak Agent 8.2.16 and newer versions, and automatically identifies known mouse-jiggling apps on Windows and Mac.

Ready to set this up? Check out our Alarm Overview Article for step-by-step instructions on configuring out-of-the-box Alarms, like PFA: Input Simulation Software. For this specific Alarm, we recommend:

Repetitive Activity Detected

This alarm detects uniform, repetitive patterns that don't resemble normal human behavior. Consider keys being held down, clicks occurring at regular intervals, or mouse movements that repeat in a consistent pattern.

How the Agent version affects what you see:

  • Agent 8.6.7 and above: When repetitive activity is detected, ActivTrak switches the user into a false input mode and captures the full duration of that activity. Even if a new titlebar appears, the user stays in false activity mode until the repetitive activity stops. That time is excluded from all standard reports and appears as white gaps in the Gantt chart.
  • Agents prior to 8.6.7: When repetitive activity is detected, ActivTrak logs a zero-duration event in the Activity Log and moves the user to passive after 2 minutes (or your configured timeout). If a new titlebar appears, the user returns to active, and the PFA timer resets.

The repetitive activity alarm works exclusively on Windows devices and catches both software and hardware-based patterns. Like all alarms, it's a signal to dig deeper and see what's happening with your employee.

Ready to set this up? Check out our Alarm Overview Article for step-by-step instructions on configuring out-of-the-box Alarms, like PFA: Repetitive Activity Detected. For this specific Alarm, we recommend:

High Duration Activity

This Alarm flags when someone spends more than 45 minutes on a single screen. Since it's rare for employees to work on the same screen for that long without switching tabs or going passive, this usually indicates that someone is using software or a device to mimic activity. Unlike the other two PFA alarm types, this alarm always includes a duration value in the Alarm Log.

The 45-minute default is based on an analysis of activity patterns across more than 9,500 customers over several years. You can adjust this threshold if you have employees whose work keeps them in specific applications for extended periods.

Ready to set this up? Check out our Alarm Overview Article for step-by-step instructions on configuring out-of-the-box Alarms, like PFA: High Duration Activity. For this specific Alarm, we recommend:

How to investigate

Don't just react to a single alarm - these work best when you look at the bigger picture of what's happening with that employee.

  1. Start with the Alarm Log

Click the link in your notification or go to Notifications > Compliance Alarms > Alarm Log to see what triggered the alert. Filter by User and alarm type to spot patterns. Is this a one-time thing, or does this person set off alarms regularly?

  1. Use the Alarm Analysis

This report saves you time by showing alarm patterns without manual filtering. Go to Notifications > Compliance Alarms > Alarm Analysis, and select the User to see their alarm history. You can easily compare this person against your team's standard patterns.

  1. Get advanced insights with BI templates

If you have ActivConnect, install our Potential False Activity Analysis for BI to gain deeper workforce insights. This helps you spot trends over time and determine if suspicious activity is persistent or just a one-off incident. (Need help setting this up? Contact our Support team.)

  1. Check the Activity Log

Go to Technology & AI Usage > Activity Log and look at what happened before and after the alarm. Does everything look normal, or do you see a long stretch of weird activity? What software was running when things got flagged?

Want to see all recent artificial activity? Search "artificial input" in the Description field in the Activity Log (try the last 30 days) to get the complete picture of what ActivTrak has been catching.

  1. Look at productivity patterns

Head to Workforce Management > Productivity Trends for that date and set the timeline to 5-minute intervals. 

When ActivTrak detects repetitive patterns, it immediately reclassifies that activity. Here's what that looks like — and it depends on which agent version is installed:

Agent version 8.6.7/9.0.0: When PFA is detected, the activity immediately moves to a tracked internal state that is excluded from all standard reports. The productivity category — Productive or Unproductive — does not change. That time simply becomes invisible to reports for the full duration of the false activity, appearing as white gaps in the Gantt chart timeline.

Older Agent versions (pre-8.6.7): When PFA is detected, the activity immediately switches from Active to Passive. The productivity category does not change — if the User was on a Productive app, it remains measured as Productive. After the default 5-minute timeout, Passive time transitions to Inactive, which appears as white gaps in the Gantt chart timeline.

In both cases, a User using tools to fake activity will typically show low Productive Active Time and white gaps during the detection period. The Alarm Log (in the cases where an Alarm was active) and Activity Log (in all cases of PFA detection) will show you exactly when detection occurred, giving you a clear timeline to reference.

Note: Reclassification occurs automatically, whether or not the alarm is turned on. The alarm simply notifies you that it occurred, so you know when to investigate.

  1.  Review screenshots (if available)

Screen captures can be your best evidence. If you're seeing repeat offenders, consider setting up custom multi-screenshot alarms for specific Users. Being able to see how the screen changes (or doesn't) during suspicious activity gives you concrete proof of what's really happening.

How to respond

Once you've confirmed a PFA incident, use these workflows to take appropriate action consistently. The right response will depend on your organization's internal policies — the guidance below reflects what customers typically do in practice.

Confirmed software PFA (single incident)

  1. Capture documentation of the activity-mimicking software usage
  2. Notify HR and IT
  3. Block the software tool at the device or network level
  4. Have the HRBP and/or manager address the behavior with the employee in accordance with your technology usage policy

Recurrent repetitive pattern or high duration (7+ day analysis)

  1. Identify employees to investigate. On a regular basis, review the Alarm Log or your BI dashboard, filtering for incidents over the last 7–30 days.
  2. Drill into the evidence. For employees averaging more than 2 incidents per day, examine the log and screenshots for at least 5 triggered incidents.
  3. Confirm sufficient evidence. Look for signs such as the user staying in the same application or document without any visible change, or repeatedly entering the same character. If evidence is sufficient, proceed with the corrective action workflow above.

The bigger picture

These alarms are signals to investigate and understand what's really going on. Use ActivTrak's investigation tools to gain full context, then engage with employees who may be struggling with disengagement. Tools like Coaching Opportunities and Workload Balance can help address underlying issues once they are identified.

Keep in mind:

Operationalizing the PFA checklist

Before acting on PFA alarms, we recommend that your organization has these foundations in place:

  • Technology usage policy — document what constitutes prohibited activity-mimicking behavior and what consequences apply if an employee uses such software or hardware.
  • Validation training — ensure the people reviewing alarms understand the validation steps for each PFA type (software, repetitive pattern, high duration) before taking action.
  • Defined ownership — establish who owns each step: who receives alerts, who confirms incidents, who notifies HR, and who conducts the employee discussion.
  • Alarm configuration — enable all three PFA alarms, configure screenshot capture, and exclude known false-positive executables (e.g., remote desktop tools) from High Duration conditions.
  • Regular cadence — schedule a weekly or bi-weekly review of the Alarm Log or BI dashboard, rather than reacting only to individual alerts.

Learn more

Was this article helpful?
28 out of 37 found this helpful