Lab-sourced indicators
Indicator feed sourced from published Amnesty International Security Lab and Citizen Lab STIX2 bundles — the same attribution data used by forensic researchers investigating Pegasus-class mercenary spyware.
Per-app data-egress control
See what your apps are sending. Stop the ones you don't trust.
Apps you trust open connections in the background — to servers you didn't pick, in countries you never approved. NetInsightPro names every app, shows where it sends data, and lets you cut the connection in one click.
No card · Windows / Linux / Android · Your data stays on your device
NetInsightProTenant: techprof
live
Apps observed (last 5 min)🔔 2 anomalies
| App | Destination | Bytes | Verdict |
|---|---|---|---|
| chrome | google.com | 4.2 MB | |
| slack | slack.com | 423 KB | |
| cursor | openai.com | 25 KB | |
| ollama | localhost | 1.8 MB | |
| unknown | 185.220.101.x | 73 KB |
chrome
google.com4.2 MB
slack
slack.com423 KB
cursor
openai.com25 KB
ollama
localhost1.8 MB
unknown
185.220.101.x73 KB
0.0%Enterprise uptime SLA
0/7On-device monitoring
Supported platforms & integrations
- Windows 11
- Windows Server 2022
- Ubuntu 20.04+
- Debian 12
- Fedora 38+
- Android 7.0+
- macOS (soon)
- WFP
- Netfilter
- VpnService
- OCSF
- SCIM 2.0
- OIDC
- .NET
- Python
- Node.js
The gap
What existing tools miss
The problem
- Firewalls block ports, not apps
- Wireshark shows packets but can't act
- Cloud SIEMs see what they see, not what you lose
- Mercenary/Pegasus-class spyware egress hides in normal traffic
- AI-worm / LLM-exfil traffic slips past signature-based tools
How NetInsightPro closes it
- Per-app attribution at the kernel level
- One-click block — instant, no reboot
- Local-first: data stays on your device
- Spyware Shield: desktop egress matched to lab-attributed infra — indicators, not diagnosis (Pro, early access)
- AI-worm heuristics flag LLM egress + C2 polling (early access)
Documented threats we detect
These aren't hypotheticals.
The AI-era threats NetInsightPro is built to surface are documented in the security literature — demonstrated by researchers and confirmed in the wild. The per-app egress signal is what surfaces them.
AI-augmented malware crossed from theoretical research into confirmed state-sponsored use in 2025. CrowdStrike documented an 89% surge in AI-enabled adversary operations in their 2026 Global Threat Report.[5]
Morris II
March 2024
First demonstrated self-replicating worm targeting GenAI ecosystems. Exploited RAG database poisoning and adversarial prompt embedding to propagate across ChatGPT-4, Gemini Pro, and LLaVA.
PROMPTSTEAL / LAMEHUG
July 2025
First confirmed in-the-wild malware that queries a live LLM (Hugging Face, Qwen2.5) during active attacks to generate Windows reconnaissance commands, then exfiltrates documents via SSH to attacker C2.
SesameOp
November 2025
Backdoor using the OpenAI Assistants API as its C2 channel. A .NET DLL polls an attacker-controlled OpenAI account for encrypted commands — traffic is standard HTTPS to api.openai.com, indistinguishable from legitimate developer use by TLS inspection.
Security posture
Built to be audited, not just trusted.
We publish our security posture and run a responsible-disclosure programme. SOC 2 Type II and ISO 27001 audits are in progress — target 2026; we don't claim certifications we don't yet hold.
Security posture document available under NDA on request.
AI-era threat detectionEarly Access
First per-app firewall that catches AI-powered worms
AI-augmented malware now queries ChatGPT and Claude during live attacks to generate recon commands and evade detection. NetInsightPro is the first per-app firewall with dedicated detection for LLM-orchestrated threats — at the network layer, without reading your prompts.
- LLM API egress monitoring — alerts when malware queries ChatGPT/Claude/Gemini from non-browser processes
- Lateral move detection — flags follow-up internal connections within 60s of LLM contact, signal of LLM-orchestrated reconnaissance (H5)
- Swarm detection — escalates when 3+ hosts in your network show the same unknown process hash making LLM API calls within a 5-minute window (H7)
Your network data stays on your device. Insight is local. Control is yours.
— NetInsightPro design principleAI threats need AI defense — on every endpoint, not in the cloud.
— NetInsightPro design principleCompliance is enforced, not promised. EU/UK data residency by default.
— NetInsightPro design principle
Pro — Defensive security
Spyware Shield: surface connections attributed to mercenary spyware.
NetInsightPro correlates your Windows and Linux desktop egress against lab-sourced indicators published by Amnesty International Security Lab and Citizen Lab — the same STIX2 feeds that power Amnesty's Mobile Verification Toolkit. When your device opens a connection to infrastructure previously attributed to Pegasus-class spyware, Spyware Shield flags it — as an indicator, not a confirmed infection.
This is desktop network-egress monitoring. It complements, and does not replace, expert forensic analysis tools such as Amnesty MVT. A finding means a connection was observed to attributed infrastructure — it does not diagnose an infection. For confirmation, contact Amnesty Security Lab.
Auto-updating indicator feed
Indicators refresh automatically from upstream lab publications. New infrastructure attributions are incorporated on a nightly cadence, so your egress is checked against current, published threat intelligence without manual updates.
Tiered, responsible reporting
Findings are surfaced with confidence tiers — not a binary infected/clean verdict. Each indicator report cites the source attribution and refers you to Amnesty Security Lab for expert forensic confirmation. Spyware Shield raises a flag and points to the right experts.
Pro tier · Windows & Linux desktop · Indicators only, not a diagnosis
Desktop-first: Windows and Linux egress matching is available now. Mobile destination-level monitoring requires a separate VPN-layer component not yet built. Spyware Shield does not detect on-device iOS or Android infections — for mobile forensics, use Amnesty MVT.
Platform features
Six capabilities. One lightweight agent.
From raw packet attribution to enterprise SSO — all without sending your flow data to anyone.
Interactive product demo: an animated cursor opens the AI Threats tab of the admin console, selects a high-severity LLM-exfiltration anomaly, and blocks its egress across the fleet. Illustrative data.
Per-app visibility
Every outbound connection tagged to the process that opened it — not just the IP or port. See exactly which app is talking to which server.
Byte-level monitoring
Real-time byte counts, connection timelines, and destination breakdowns per app. Nothing is aggregated away.
Allow / block rules
One-click block any app at the kernel level. Rules persist on your device — no reboot, no service restart, no cloud sync required.
Enterprise
SIEM forwarder (OCSF)
Push structured OCSF events to your SIEM via webhook. Integrate with Splunk, Elastic, or any webhook-capable endpoint.
Hybrid
Hybrid deployment
Keep raw telemetry on your own infrastructure. Cloud sees only Ed25519-signed daily digests. BYO object storage + KMS.
License-only telemetry
The only signal we receive: your licence key + a hardware fingerprint hash. No flow data, no app names, no destinations — ever.
Intelligence layer
Anomaly detection on per-app egress.
Smart alerts fire when outbound bytes deviate from your 7-day EWMA baseline. Per-tenant threshold tuning via policy.
- Flags the app, new destinations, and excess byte volume
- Side-by-side baseline vs. spike comparison
- One-click block + optional OCSF SIEM forwarding
Dashboard
Real-software proof.
The same dashboard view — web admin for fleet ops, device client for personal control.
0apps monitored
0.0GB out today
0anomalies this week
0data leaks
Installersv1.0.0+42 · via /download
Build 42
Windows 10/11
x64 installer
12.0 MB
Build 42
Linux x64
x86_64 tar.gz bundle
11.9 MB
Build 42
Android 7.0+
arm64 · arm32 · x86_64
71.0 MB
Coming soon
macOS
Apple Silicon + Intel
All installers sha256-verified · account required · Download page →
LivePublished 5 Jul 2026
Windows
x64
- Version
- v1.0.0+42
- Size
- 12.0 MB
- Built
Linux
x86_64
- Version
- v1.0.0+42
- Size
- 11.9 MB
- Built
Android
arm64 · arm32 · x86_64
- Version
- v1.0.0+42
- Size
- 71.0 MB
- Built
macOS
Apple Silicon + Intel
- Version
- Coming soon
- Size
- —
- Built
- —
sha256 —
Full SHA-256 manifest at releases.netinsightpro.com/latest.json · Download page
How NetInsightPro works
From endpoint signal to operator alert — one unified pipeline, fully on-host or hybrid.
Data Sources
Endpoints · Firewall · DNS
Collectors
On-host · Hybrid · Cloud
Analytics Engine
Stream · Enrich · Index
Threat Detection
Anomaly · AI-Worm · Lateral
Dashboards & Alerts
Per-tenant · SIEM · Pager
- Data SourcesEndpoints · Firewall · DNS
- CollectorsOn-host · Hybrid · Cloud
- Analytics EngineStream · Enrich · Index
- Threat DetectionAnomaly · AI-Worm · Lateral
- Dashboards & AlertsPer-tenant · SIEM · Pager
Security & compliance
Built for enterprise trust.
Security architecture
- Ed25519-signed daily digests (Hybrid tier)
- mTLS between agent and collector
- RBAC — per-seat role enforcement
- Immutable audit log
- On-prem Hybrid deployment (your infra, your keys)
- BYO KMS — encryption keys never leave your account
Compliance & standards
- SOC 2 Type II — audit in progress 2026
- SAML 2.0 / OIDC SSO
- SCIM 2.0 provisioning
- UK GDPR · EU GDPR
- DORA · BSI C5 · NIS2 alignment (Hybrid)
No banned dates. SOC 2 Type II audit in progress — target 2026; security posture document available under NDA on request.
SIEM integration
Sample OCSF event forwarded to your SIEM
{
"metadata": {
"version": "1.3.0",
"product": { "name": "NetInsightPro", "vendor_name": "NetInsightPro Ltd" }
},
"class_uid": 4001,
"category_name": "Network Activity",
"activity_name": "Established",
"severity_id": 3,
"time": 1717862400000,
"src_endpoint": { "ip": "10.0.4.17", "hostname": "ws-eu-014" },
"dst_endpoint": { "ip": "104.18.32.7", "hostname": "api.openai.com" },
"connection_info": { "protocol_name": "tcp", "direction": "outbound" },
"observables": [{ "name": "ai_threat_subtype", "value": "llm_exfil_suspect" }]
}How we compare
NetInsightPro vs. the alternatives
Wireshark shows packets but cannot block. Firewalls block ports but cannot see which app sits behind them. Only NetInsightPro gives you per-app control across Windows, Linux, Android — plus enterprise SSO.
| Product | Per-app granularity | Windows | Linux | macOS | Android | Real-time blocking | Enterprise SSO | Data stays local | Spyware-egress detection | AI-worm detection |
|---|---|---|---|---|---|---|---|---|---|---|
| NetInsightPro | Soon | |||||||||
| Wireshark | ||||||||||
| Little Snitch | ||||||||||
| PortMaster | ||||||||||
| OpenSnitch |
Scroll to compare →
macOS support is in development (notarisation pending). Enterprise SSO = SAML 2.0 / OIDC built-in. Spyware-egress detection: Pro tier, Windows/Linux desktop — flags connections to infrastructure attributed to mercenary spyware by Amnesty/Citizen Lab (network indicators, not on-device forensics). AI-worm detection: early access.
Founding design partners
We're building this with our first teams.
NetInsightPro is pre-launch. We're inviting a small group of founding design partners to shape the product with us — early access, direct line to the team, and the Founding Customer offer (50% off year one). No customer logos here yet — because we won't fake them.
Your team hereFounding partner
Your team hereFounding partner
Your team hereFounding partner
Your team hereFounding partner
Pre-launch: these slots are open. We don't display customers we don't have.
Start in 60 seconds. Your data never leaves.
Free account, no card. Create one in seconds, download the installer, and see your app traffic in minutes.
No card required · Windows / Linux / Android · Your data stays on your device