Keyloggers typically pick up local keystrokes, not remote sessions.

Terminal 5250 is just another horrible mainframe emulation such as erma 3270. I have tons of that crap spread around my environment. Do you use ACF2? It's a horrible mainframe security suite. If you want to kill yourself, go play with it.

We had the same issue but then our C level folks allowed us to rewrite our policies which now include consiquences for bad actions. We've also switched over to a risk based model simply because using the strict list model, we cannot cover every situation that we come into contact with.
OK, I'm starting to run off with the thread. Sorry, now back to our regularly scheduled program.