We had a situation where we had to use monitoring software to try to catch a very random issue that we suspected was user error, but the user was very obstinate it was a system error.

The software we found, the "features" are abhorrent in my opinion - the screen recording was what we purchased for, and we disabled everything else.

Thing is, we've discussed this with the specific employee involved and shown them exactly what we can see, and exactly what we can't see. Informed them that only I can see the data and will only use it when that specific problem is reported.

Watching seems to have reduced the incidence of the error, it was happening once or twice every 3 weeks, but it's not happened within the past 7 weeks at all.

It's "saved" us about 5k so far, so I can see why it's attractive.