EchoMark Launches Screen Watermarking to Identify Sources of Information Leaks from Photos and Screen Captures

EchoMark Screen extends the company’s pioneering forensic watermarking platform to the screen, applying an invisible steganographic watermark to the entire computer display through a single OS-layer deployment, covering any application and content type.

BELLEVUE, Wash.--(BUSINESS WIRE)--EchoMark, the award winning invisible forensic watermarking company that enables organizations to identify the source of information leaks, today introduced EchoMark Screen to add invisible watermarking to everything displayed on the screen. EchoMark’s mission is to enable the seamless flow of private information, and EchoMark Screen dramatically extends steganographic watermarking coverage to all sensitive information displayed on users’ computer screens. Now when a leak occurs anywhere in the information lifecycle, the source can be identified in minutes.

In 2025, all 15 U.S. cabinet-level departments and all 10 largest companies in the world experienced damaging information leaks. These organizations have sophisticated security postures, with enterprise Data Loss Prevention (DLP), Digital Rights Management (DRM), and security operations teams, but they still could not stop leaks or identify who was responsible. In most cases, the investigation ended inconclusive because the likely leak vector was a phone photograph of a screen: no file moved, no email was sent, no DLP alert fired. There was simply no way to tie the photograph to a specific person or session. Some organizations suffered ongoing information leaks for years before using EchoMark to quickly remedy the situation.

EchoMark Screen is built to provide conclusive evidence for that investigation. Using proprietary AI-powered algorithms and steganographic techniques, the product embeds an invisible, unique watermark directly at the Windows display layer, marking everything the screen renders, across every application simultaneously. When a screen is photographed or captured as a screenshot, the watermark persists in the image even though it is invisible to users. Security and compliance teams upload the leaked artifact to EchoMark's investigation tool to receive a forensic report in minutes, with a confidence score, device ID, session timestamp, and chain-of-custody documentation.

“An organization can utilize all the conventional information protection tools, but sensitive information can still escape via a photograph of a screen,” said Troy Batterberry, CEO and Co-founder of EchoMark. “EchoMark is the only company that watermarks plain text, the most leaked form of information, in emails and documents. EchoMark Screen extends that same forensic certainty to the display itself, building toward our vision of making every piece of sensitive information traceable, wherever it lives.”

A single deployment that marks every application and content type

The practical challenge with protecting content as it is being viewed and edited is the breadth of the application environment. An enterprise runs thousands of applications including productivity suites, collaboration platforms like Microsoft Teams and Slack, line of business applications, custom dashboards, AI assistants, and ERP systems. Watermarking each one independently would be technically complex, operationally onerous, and obsolete as soon as a new application is introduced.

EchoMark Screen requires no integration into any application or browser and does not modify any content or data. There is no workflow to change, and no indication to the user that their screen is marked. It persists across all applications simultaneously and survives camera photographs of the screen. The invisible watermark operates as the enforcement mechanism, but administrators can optionally enable a visible watermark as well. When enabled, the visible layer functions as a deterrent: it signals to users that their session is marked and that accountability is real, changing behavior before a leak occurs. The two operate independently - visible marking for deterrence, invisible marking for attribution - and both can be active simultaneously.

EchoMark Screen is currently available for IT-managed Windows PC endpoints via standard enterprise distribution tools and can be deployed organization-wide in hours rather than the weeks or months required by application-level integrations. It supports dedicated and shared workstations as well as virtual desktop infrastructure (VDI) environments. For environments where multiple users share a device or a single account spans multiple shifts, attribution is resolved using device ID and session timestamp.

Completing the EchoMark platform: from distribution to display

EchoMark Screen joins a platform that now covers the full information lifecycle. EchoMark Email automatically watermarks the body and attachments of outbound emails through integrations with Microsoft Exchange and Google Workspace, including if the recipient is external and not using EchoMark. EchoMark File Share watermarks documents as they are distributed with a shareable link. The EchoMark API enables integrations for organizations that need watermarking embedded directly into proprietary applications or workflows.

Together, these capabilities mean that sensitive information is marked at every point it can be exposed: when it is sent, when it is shared, and now with the introduction of EchoMark Screen, when it is viewed. When a leak occurs anywhere in that lifecycle, the investigation follows the same workflow: upload the artifact to EchoMark's investigation tool and receive a forensic report in minutes, complete with attribution, a confidence score, and chain-of-custody documentation.

Organizations can request a demonstration of EchoMark Screen at echomark.com/schedule-a-demo.

About EchoMark

EchoMark empowers organizations to identify the source of information leaks, often in minutes. The platform uses steganographic techniques to embed invisible, individualized watermarks into emails, documents, shared files, and computer screens. When sensitive information leaks in any form - a photograph of a screen, a printed document, a screenshot, or copied email text - EchoMark’s software identifies which copy was the source, with forensic evidence and chain-of-custody documentation.

EchoMark serves major government organizations and Fortune 100 customers across financial services, gaming and entertainment, professional services, technology, manufacturing, and more, including in government special cloud and air-gapped environments. The company is backed by Craft Ventures and In-Q-Tel, was recognized as a Gartner Cool Vendor in 2024, and was named Insider Threat Detection Platform of 2025 by the Cybersecurity Breakthrough Awards.