Understanding the Unusual Activity Report in WorkComposer
AI-Powered Detection for Authentic Work Patterns
Not all activity means real work. Some employees may use mouse jiggling tools or keep keys pressed continuously to appear active — creating misleading productivity data and making it harder for managers to trust what they see in their reports.
That's where WorkComposer's AI-powered Unusual Activity report comes in. It automatically flags patterns of suspicious behavior — such as constant typing or mouse movement lasting over 30 minutes without even a 10-second pause. These patterns often indicate artificial attempts to remain "active" within the system, whether through mouse jigglers, keyboard macros, or other automation tools.
This intelligent detection system provides managers with clear visibility into irregular activity patterns, eliminating the need for guesswork or micromanaging. Instead of wondering whether your team members are genuinely working, you get data-driven insights that help you make informed decisions with confidence.
When and How Unusual Activity Notifications Appear
WorkComposer continuously monitors work patterns in the background, requiring no manual setup or configuration. The system runs automatically from day one.
Automatic Detection
When WorkComposer detects continuous, uninterrupted activity — such as non-stop mouse movement or typing for more than 30 minutes without a single 10-second pause — it automatically displays a red "Unusual Activity" alert beneath the user's name in the Overview report.
There's no setup required — this feature runs in the background by default, protecting your organization from inflated activity data without any administrative overhead.
Detailed Activity Charts
Clicking on the alert opens a detailed activity chart, allowing you to review exactly when and where the suspicious pattern occurred. This visual representation helps you identify trends, review specific time periods, and make informed decisions quickly and easily.
Click image to enlarge
Detection Criteria: The AI looks for patterns where keyboard or mouse input continues for 30+ minutes without any natural pauses (at least 10 seconds). Real human work naturally includes brief moments of reading, thinking, or switching tasks — artificial tools don't.
Understanding Activity Patterns in WorkComposer
Not all activity patterns are created equal. Learning to interpret the different patterns helps you distinguish between genuine focused work and potential manipulation attempts.
Normal Activity Pattern
A typical workday usually shows a healthy rhythm of activity and breaks, with no red alerts appearing on the timeline. This reflects a natural and productive workflow where the employee engages with their work, takes natural pauses to read, think, or briefly step away, and returns to active work throughout the day.
This is what genuine productivity looks like — a mix of focused work periods with natural breaks that occur organically as part of the work process.
Click image to enlarge
What this means: The employee is working naturally with organic breaks. No further action needed — this is expected and healthy behavior.
Occasional Spikes Pattern
A few red markers may appear during periods of deep focus — such as while writing documentation, coding intensely, designing, or performing data entry tasks. These occasional alerts aren't necessarily concerning, as certain types of legitimate work can involve extended periods of continuous input.
For example, a developer debugging code, a writer completing an article, or a designer working in creative software might trigger one or two alerts during particularly focused sessions. This is natural and can be worth reviewing for context, but it's rarely a red flag on its own.
Click image to enlarge
What this means: Likely legitimate deep-focus work. Consider the employee's role and tasks. If it's a one-time occurrence or matches their job description (coding, writing, designing), it's probably normal. Worth noting but usually not a concern.
Abnormal Activity Pattern
If the activity chart is filled with red alerts throughout the entire workday — appearing consistently every 30 minutes like clockwork — it indicates continuous activity with no natural breaks whatsoever. This highly unusual pattern strongly suggests attempts to manipulate activity data using tools like mouse jigglers, keyboard macros, or other artificial input devices.
Real human work simply doesn't look like this. Even the most focused tasks include brief moments of reading, thinking, reviewing, or natural pauses. When you see this pattern, it's a clear red flag that warrants immediate investigation by management.
Click image to enlarge
What this means: High likelihood of artificial activity generation. This pattern is a serious red flag that typically indicates the use of mouse jigglers or similar tools to fake productivity. Immediate investigation and conversation with the employee are strongly recommended.
How to Assess Unusual Activity Accurately
To ensure a fair and accurate evaluation of work performance while maintaining trust with your team, follow these recommended steps when investigating unusual activity alerts.
Review the Screenshots
Start by examining the screenshots captured during the flagged time periods. Look for static or unchanged screens despite high activity levels. If you notice the exact same screen content across multiple screenshots while the system reports continuous mouse or keyboard activity, this strongly indicates non-genuine engagement.
Key indicators to look for:
- Identical screenshots across multiple time intervals
- Screensavers or lock screens appearing while activity is recorded
- Static content (like a paused video or idle application) with no visible changes
- Applications that don't match the type of work the employee typically performs
Have a Quick Check-in with the Employee
Before jumping to conclusions, engage in an open, non-accusatory conversation with the team member. Sometimes, legitimate focused tasks — such as writing lengthy documents, designing graphics, reviewing code, or performing detailed data entry — can lead to extended periods of continuous input without breaks.
Understanding the nature of their role and current responsibilities will provide essential context for what the system detects. Ask questions like:
- "What project were you working on during [specific time period]?"
- "Can you walk me through what you were doing that required such focused attention?"
- "Is this type of work pattern typical for your current tasks?"
A genuine employee will typically be able to explain their work clearly and provide specific details about what they accomplished during those periods.
Look for Repeating Patterns Over Time
One instance of unusual activity could be legitimate deep focus. However, if unusual activity appears regularly across multiple days — especially if it follows a predictable pattern (like appearing at the same times each day or throughout entire work weeks) — it strongly indicates an attempt to manipulate tracked time.
Review activity reports over:
- The past week to identify daily patterns
- The past month to spot consistency
- Different times of day to see if alerts cluster at specific hours
- Comparison with other team members in similar roles
Recurring suspicious patterns across multiple days warrant a deeper review and potentially more serious intervention.
Cross-Reference with Deliverables and Output
Compare the reported activity hours with actual work output and completed deliverables. Are they producing the expected results given the hours tracked? Are project milestones being met on time?
If someone shows 8-10 hours of continuous activity daily but delivers minimal work product, this misalignment is a strong indicator of inflated activity reporting.
Use as a Conversation Starter, Not a Conclusion
WorkComposer's Unusual Activity report is designed to help you catch inflated activity and maintain data integrity, but not every alert automatically signals misconduct. In some teams and roles, deep focus work is simply part of the job. That's why we recommend using this tool as a conversation starter and investigation aid — not as an automatic conclusion or grounds for immediate disciplinary action. Context matters, and understanding your team's work patterns is essential for fair evaluation.
Best Practices for Managers
Monitor Proactively
Review unusual activity reports regularly rather than waiting for issues to escalate. Early detection and conversation prevent larger problems and maintain team trust.
Communicate Transparently
Be open with your team about how the unusual activity detection works. Transparency builds trust and helps prevent misunderstandings or attempts to manipulate the system.
Consider Context
Always evaluate alerts within the context of the employee's role, current projects, and typical work patterns. One size doesn't fit all when it comes to productivity monitoring.
Document Everything
Keep records of unusual activity patterns, conversations with employees, and any actions taken. This documentation is crucial for fair management and potential HR processes.