Activity percentages on time-tracking dashboards are basically a compressed view of mouse and keyboard input. Hardware jigglers, software “movers,” and keep-awake scripts exist because they game that view: they keep the green bar green without proving anyone is working. Richer Windows endpoint data—apps, session state, files, network—can make fake presence look thin. Correlation still isn’t proof. If your company treats activity % as honesty, you’re measuring the wrong thing.This got loud when remote and hybrid work turned “presence” into a management proxy. Billing fights, contractor timesheets, and always-on Slack status rewarded meters that look objective. A cheap USB gadget that nudges the cursor—or a script that fakes input—isn’t a clever attack on your stack. It’s a rational response to a bad metric. The dashboard isn’t broken. The metric was never presence.Three questions managers keep collapsing into oneMost arguments about idle time and jigglers start the same way: leaders ask three different questions and expect one number to answer all of them.Was there input? Mouse moves, clicks, keypresses in a time window.Was the person actually working? Foreground apps, websites, documents, meeting context.Was there risk or a policy issue? USB copies, weird file paths, blocked sites, odd hours on sensitive data.Activity % mostly answers question one—and not well. It can’t tell a human hand from a HID gadget that looks like a mouse, or from injected events. It also can’t tell “reading a long design doc on a second monitor” from “away from the desk.” Pure idle rules punish real work: light typing on video calls, long compiles, research that’s mostly scroll-and-think.If the risk is payroll honesty, you need more than input volume. If the risk is data loss, mouse motion barely matters. Smash those goals into one green percentage, and jigglers win.What SaaS “activity %” usually seesA typical desktop agent for time tracking does some version of this:HID / OS input events ↓ Desktop agent ↓ Time buckets (e.g. 1–10 min) ↓ Activity percent ↓ DashboardWindows already has basics for input idle detection. Microsoft’s GetLastInputInfo returns the time of the last input event for the session that called it—not magic proof that “the employee is working.” Agents may use last-input APIs, raw input hooks, or their own sampling of moves and keys. Same bottom line either way: the meter counts motion in a bucket, then paints a percentage.That percentage does not prove:real focus or meeting attention,that someone’s at the desk,that a human made the input,that the work was billable or allowed by policy.Jigglers win because they feed the same event class the meter counts. You don’t need a novel exploit. You need the sensor’s blind spot.A short taxonomy (for detection—not a how-to)ClassWhat it fakesWhat it usually fails to fakeUSB HID “mouse” / moverSteady move or clickApp switching, file/network patterns, normal task hoppingSoftware mover / scriptPeriodic cursor wiggles or fake inputNatural timing, real typing, a believable app storyOS keep-awake / sleep blockersStops sleep / dimmingHigh activity % on its own—unless you also spoof inputThis is a cheat sheet for ops and security, not a recipe book. The story is already public: banks and big employers have fired people over simulated keyboard activity and “mouse movers,” including Wells Fargo, as reported by the BBC. The takeaway isn’t “buy a detector.” It’s that if you treat input as proof of work, you create demand for tools that fake input.Some monitoring vendors pitch dedicated “jiggler detection.” Treat that as marketing until you know which signals they use. Motion-only heuristics are brittle. Multi-signal context is where suspicion gets useful.What richer endpoint telemetry can catchOnce you instrument a Windows PC beyond “how much did the mouse move,” you get a stack. Each layer does a different job. None of them is a courtroom.LayerExamplesUseful against jigglers?Input volume onlyMove/click/key countsNo—this is what jigglers targetSession stateLock/unlock, console vs remote, idle timeoutSomewhat—locked + “active” deserves a lookProcess / app timelineForeground app, launch/exitYes—hours “active” on one junk process looks thinWeb / search (sensitive)URLs, queriesYes—heavy on privacy; policy firstFile / USB / print / clipboardChannel activityStrong for fraud and DLP; different goal than time cheatingNetworkInterfaces, per-app trafficHelps separate real work from empty motionScreens / live viewSpot checksHuman review; too sensitive for first-line payroll fightsAnomaly / rule hitsAlerts in a queueOps workflow—not a magic classifierHard truth: more signals raise suspicion. They don’t prove guilt. A quiet engineer on a call can look “idle.” A jiggler with a real IDE open can look “busy.” Treat multi-signal outliers as a review queue, not an auto-fire pipeline.A simple investigation pattern:Flag — high activity with almost no app variety, or activity while the session is locked.Context — which apps and sites were up front? Any file/USB/web events? Was the agent offline earlier?Talk to a human — walk the timeline with a manager or the employee before you call it fraud.Decide — coaching, stop worshipping activity %, or escalate if the evidence holds.Watch session boundaries too. Last-input APIs are session-specific. RDP and multi-session hosts (terminal servers / RDS) make “was this the interactive user?” a real engineering problem, not a dashboard footnote. On shared Windows hosts, per-session context beats one PC-wide activity bar. Sample the wrong session and you’ll mark someone idle forever—or credit them for activity that wasn’t theirs.For the longer arc—from punch clocks to screenshots to “work intelligence”—see this Jon Stojan time tracking piece on HackerNoon. Vendors keep renaming the dashboard. The mistake stays the same when one thin sensor becomes a moral score.Security teams that care about insider risk already think in layers. NIST SP 800-53 talks about continuous monitoring and audit as control families—not as one productivity percentage. Steal that mindset: pick controls that match the risk, then store as little as you can. Need attendance trends? Don’t keep keystroke content. Need DLP? Don’t pretend mouse percentages are your control set.False positives, ethics, and policyObsessing over “catch jigglers” creates workplace theater. People learn to look busy. Trust drops. Then you get a second arms race: more invasive capture vs. smarter spoofing.A healthier setup starts with a written policy:What do you measure, and why?Who can see raw screens or keystrokes, if anyone?How long do you keep sensitive data vs. aggregates?What happens on a flag—conversation, coaching, investigation—before HR?Transparent monitoring (people know the scope) and stealth modes are policy choices, not moral absolutes. Time-tracking buyers usually want softer defaults. Security buyers often need channel visibility—files, USB, web—for insider risk. One product toggle won’t fix both cultures. That’s how you end up with dashboards that punish people who read and miss people who leak.There’s a security angle that doesn’t get enough airtime: unknown USB HID devices on managed laptops aren’t just a “productivity cheat.” They’re an endpoint hygiene problem. If you already lock down flash drives, treat mystery HID gadgets with similar seriousness. That doesn’t mean hunting every accessibility tool or specialty mouse. It means inventory, allowlisting, and clear exceptions.This isn’t legal advice. Notice, minimization, and retention rules vary by place. Put the employee-facing policy in writing before you turn agents on.Practical checklist for security and opsIf the goal is payroll / billable honestyDon’t use activity % alone in a dispute.Cross-check app/website timelines, idle gaps, and calendar or ticket context when you have it—before you accuse anyone.High activity + almost no app diversity → review queue, not auto-fire.For knowledge work, prefer outcomes and deliverables. Use telemetry to explain weird patterns, not to grade people like machines.If the goal is insider risk / DLPPrioritize channel signals (files, USB, web, clipboard) and rule hits over mouse motion.Use screen capture or live view after a signal—not as the default story of “how we manage people.”Keep “was someone present?” separate from “did sensitive data leave?” in both tools and process.Instrumentation hygieneLog session lock, remote vs. console, and agent health. Offline gaps explain more than fake green bars.Keep aggregates longer than raw keystrokes or wall-to-wall screen history when policy allows—less creep, still useful trends.Write down what you measure in the employee-facing policy before deploy.If hardware jigglers are a real concern, control unknown USB HID via endpoint policy—without turning every mouse into a witch hunt.ConclusionMouse jigglers still fool time-tracking dashboards because those dashboards often measure input motion, then ask managers to treat the number as work. Endpoint telemetry across apps, session state, files, and network can make fake presence look thin—but only as correlation, and only if you respect false positives.Measure the behavior that matches the business risk, not the easiest sensor.What single metric does your company still treat as truth—and what would you replace it with? Drop it in the comments.