Cybersecurity, simplified
See Everything.Detect Threats.Take Control.
Powerful cybersecurity without the complexity. Your antivirus asks “is this file bad?” NetInsightPro asks “where is my data going, and to whom?”
No card · Runs alongside your antivirus · Windows / Linux / Android · Your data stays on your device
| App | Destination | Region | Out | Verdict |
|---|---|---|---|---|
| chrome.exe | www.google.com | US | 182 KB | Allowed |
| Teams.exe | teams.microsoft.com | EU | 64 KB | Allowed |
| svc_helper.exe | api.openai.com | US | 12 KB | LLM egress |
| Cursor.exe | mcp.local:7331 | Local | 3 KB | MCP agent |
| updater.exe | cdn-dl.example.net | RU | 8.2 MB | Anomaly |
Live intelligence layer
Hover a card for details · illustrative figures
Spyware Shield
41 new indicators today — Nightly STIX2 feeds from Amnesty & Citizen Lab
Spyware Shield — Learn more →AI-worm detection
14 LLM calls from non-browser apps — Flags malware that queries ChatGPT or Claude mid-attack
AI-worm detection — Learn more →AI agents & MCP
1,204 agents risk-scored — Every Claude, Cursor and MCP server, ranked Low to Critical
AI agents & MCP — Learn more →Data sovereignty
9 countries reached today — See which jurisdiction each app sends your data to
Data sovereignty — Learn more →Per-app firewall
12 hosts blocked today — Block a destination host on Windows, Linux and Android
Per-app firewall — Learn more →Hybrid / on-prem
0 raw events sent to our cloud — Only Ed25519-signed digests leave your perimeter
Hybrid / on-prem — Learn more →
See where your data and services connect. Detect spyware, suspicious behaviour and AI-driven anomalies — and surface the network activity of malware and trojans your antivirus can’t see.
See Everything
See what’s happening across your devices, data and connections.
Detect Threats
Detect threats, anomalies and suspicious activity before they become a problem.
Take Control
Block unwanted services, connections and destinations with a click.
Per destination host on Windows, Linux and Android, enforced by the OS firewall — not per app, not yet on macOS.
Watch Data Live
Every byte in and out, per app, as it happens.
First per-app firewall that catches AI-powered worms.
AI-augmented malware now queries ChatGPT and Claude during live attacks to generate recon commands and evade detection. NetInsightPro has dedicated detection for LLM-orchestrated threats — at the network layer, without reading your prompts.
→ 10.0.4.12:445 · 10.0.4.19:445 (+38s)
See and secure the AI agents & MCP servers on your fleet.
AI assistants like Claude Desktop and Cursor now run local tools through MCP (Model Context Protocol) — a fast-growing, mostly invisible endpoint attack surface. NetInsightPro discovers every AI agent and MCP server, risk-scores each one with evidence, and lets you block a risky one in a click.
Discovery & inventory
Find every AI agent and MCP server running across your Windows, Linux and Android endpoints.
Risk scoring with evidence
Each one scored Low to Critical, with the evidence and drill-down behind the verdict.
One-click block
Block a risky agent or MCP destination across the fleet in a single click.
Discovery, inventory, risk-scoring and blocking are live today. Vulnerability scanning is included and rolling out.
Pro — Defensive security
Spyware
Shield.
Continuous, fleet-wide detection of connections to mercenary-spyware infrastructure.
Every Windows and Linux desktop is monitored for connections to infrastructure attributed to Pegasus-class spyware — always on, updated nightly, no manual scans. Powered by the published STIX2 feeds from Amnesty International Security Lab and Citizen Lab.
Pro tier · Windows & Linux desktop · Evidence-backed detection · Early access
Continuous, fleet-wide
Egress checked across your whole fleet as connections open — a match surfaces as soon as it’s observed, not in a later forensic sweep.
Nightly-updated intel
The indicator set refreshes automatically every night from the published lab feeds — no manual updates.
Tiered, responsible reporting
Confidence tiers, never a binary infected/clean verdict. Each report cites its source and points to expert forensic confirmation.
A flag is an indicator, not a diagnosis. Spyware Shield complements, and does not replace, expert forensic tools such as Amnesty MVT, and does not detect on-device iOS or Android infections.
Platform features
Your antivirus asks “is this file bad?” NetInsightPro asks “where is my data going — and who’s receiving it?”
See every connection your devices make, trace it to the app and destination behind it, and cut it off in one click. Enterprise-grade network intelligence, without the enterprise complexity.
Per-app visibility
Every outbound connection tagged to the process that opened it — not just the IP or port. See exactly which app is talking to which server.
Byte-level monitoring
Real-time byte counts, connection timelines, and destination breakdowns per app. Nothing is aggregated away.
Allow / block rules
One-click block of a destination host, enforced by the OS firewall. Rules persist on your device — no reboot, no restart, no cloud sync. Windows, Linux and Android.
SIEM forwarder (OCSF)
Push structured OCSF events to your SIEM via webhook. Integrate with Splunk, Elastic, or any webhook-capable endpoint.
Hybrid deployment
Keep raw telemetry on your own infrastructure. Cloud sees only Ed25519-signed daily digests. BYO object storage + KMS.
License-only telemetry
The only signal we receive: your licence key + a hardware fingerprint hash. No flow data, no app names, no destinations — ever.
Data insight · live
Watch every byte
in and out.
Antivirus can't show you this. See which app is downloading, which is uploading, and where to, second by second. All of it is computed on your device.
| App | In / Out | ↓ In | ↑ Out |
|---|---|---|---|
| chrome.exewww.google.com · US | 585 KB/s | 129 KB/s | |
| Teams.exeteams.microsoft.com · EU | 148 KB/s | 292 KB/s | |
| OneDrive.exegraph.microsoft.com · UK | 77 KB/s | 620 KB/s | |
| spotify.exeaudio-fa.scdn.co · EU | 233 KB/s | 15 KB/s | |
| svc_helper.exeapi.openai.com · US | 5 KB/s | 33 KB/s |
Intelligence layer
Anomalies, explained.
Not just flagged.
Each app learns its own 7-day EWMA baseline. When outbound bytes break the threshold, NetInsightPro tells you what changed, where it went and why it matters, then lets you act in one click. It's statistics you can read, not a black box.
Illustrative · simulated data
- Volume
- 48 MB today vs 4.2 MB/day baseline (11.4×)
- Destination
- cdn-dl.example.net, first seen today
- Country
- RU, never contacted by this app before
- Timing
- 03:12, outside this device's usual hours
- Signature
- Signed binary, so likely a hijacked update channel
How NetInsightPro works
From endpoint signal to operator alert — one unified pipeline, fully on-host or hybrid.
- STEP 1Endpoint agentKernel-level tagging (WFP / Netfilter / VpnService) attributes every connection to an app.
- STEP 2On-device storeFlow records stay local. We only ever see your licence key + a hardware fingerprint hash.
- STEP 3DetectionEWMA anomalies, AI / LLM egress, agent & MCP risk, spyware indicators.
- STEP 4Operator alertBlock a host in a click, or forward OCSF events to Splunk, Elastic or any webhook.
How we compare
NetInsightPro vs. the alternatives
Wireshark shows packets but cannot block. Firewalls block ports but cannot see which app sits behind them. Only NetInsightPro gives you per-app egress visibility across Windows, Linux and Android — plus enterprise SSO.
| Product | Per-app granularity | AI agent & MCP security | Vulnerability scanning | Windows | Linux | macOS | Android | Real-time blocking | Enterprise SSO | Data stays local | Spyware-egress detection | AI-worm detection |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| NetInsightPro | ✓ | ✓ | ✓ | ✓ | ✓ | Soon | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| Wireshark | — | — | — | ✓ | ✓ | ✓ | — | — | — | ✓ | — | — |
| Little Snitch | ✓ | — | — | — | — | ✓ | — | ✓ | — | ✓ | — | — |
| PortMaster | ✓ | — | — | ✓ | ✓ | — | — | ✓ | — | ✓ | — | — |
| OpenSnitch | ✓ | — | — | — | ✓ | — | — | ✓ | — | ✓ | — | — |
| Antivirus | — | — | — | ✓ | — | ✓ | ✓ | — | — | — | — | — |
| Anti-malware tools | — | — | — | ✓ | — | ✓ | — | — | — | — | — | — |
Real-time blocking = one-click blocking of a destination host, enforced by the OS firewall on Windows, Linux and Android; macOS support is in development (notarisation pending). Antivirus / anti-malware rows describe category-typical capabilities of a different protection layer (files) — NetInsightPro complements them and does not replace them.
Antivirus & anti-malware tools
“Is this file bad?”
- Malware signatures and behavioural file detection
- Quarantine and removal of what they find
- Ransomware protection for your documents
- Deep scans and clean-up of an already-infected machine
Keep them running. NetInsightPro does not scan files, does not quarantine and does not do ransomware protection.
NetInsightPro
“Where is my data going, and to whom?”
- Per-app attribution — which app opened which connection
- AI / LLM endpoint detection — when an app talks to a model provider
- Mercenary-spyware C2 indicators from published research feeds
- Data-sovereignty visibility — which jurisdiction your traffic leaves for
- One-click blocking of a destination host on Windows, Linux and Android
The network layer your file scanner was never built to watch.
Enterprise-Grade Security. Simplified.
Forget managing multiple products, complicated dashboards and fragmented alerts. NetInsightPro gives individuals, IT teams and enterprises one clear, unified view — powerful enough for enterprise, simple enough for everyone.
- Ed25519-signed daily digests
- mTLS agent ↔ collector
- RBAC per-seat roles
- Immutable audit log
- On-prem Hybrid · BYO KMS
- SOC 2 Type II — audit in progress 2026
- SAML 2.0 / OIDC SSO
- SCIM 2.0 provisioning
- UK GDPR · EU GDPR
- DORA · BSI C5 · NIS2 alignment (Hybrid)
Pricing
Pick your plan.
Your data stays yours.
Pro — start free
RecommendedProsumer visibility — the egress / AI layer alongside your AV
In-app trial: no card, no signup · subscribe to continue after day 14.
- Up to 3 devices
- 90-day flow history
- Decoded flow inspection
- Anomaly detection
- AI traffic visibility (assistants, APIs, local LLMs)
- AI agent & MCP security — discovery, risk & manual block
- AI-worm detection — LLM egress + C2 polling heuristics (early access)
- Spyware Shield (desktop egress indicators)
- Priority email support
Enterprise — quoted
For fleets / volume deployments (incl. teams)
Standard DPA + MSA on request · Redlines welcome.
- Centralised admin (any fleet size)
- SSO (SAML / OIDC) + SCIM
- SIEM webhook
- Silent MDM install
- Volume licensing + fleet policy push
- AI-worm detection — fleet-wide swarm signal + SIEM forwarding (early access)
- AI agent & MCP security — fleet-wide + auto-block + SOC
- SOC dashboard + DLP integration
- Dedicated account contact + 99.9% SLA
Runs on our Cloud Control Plane — fastest to roll out. Agent data stays on-device; only licence + audit metadata reaches the control plane.
For regulated fleets: raw telemetry stays on your network; the cloud sees only Ed25519-signed digests. UK GDPR Art. 44 · DORA · BSI C5 · NIS2 aligned.
FAQ
Frequently asked questions
- Most security tools look at files. NetInsightPro watches behaviour. Antivirus and anti-malware tools match files against known signatures, so they miss what’s never been seen before: trusted apps leaking data, silent trackers, spyware calling home. NetInsightPro shows you every outbound connection: which process opened it, where it goes and how much data it sent. Drill into any one in seconds, then block it, isolate the device or set a policy on the spot. Many users keep their existing tools; NetInsightPro covers the blind spot they leave.
Powerful enough for enterprise. Simple enough for everyone.
Know where
your data goes.
Free account, no card. Create one in seconds, download the installer, and see your app traffic in minutes.
No card required · Windows / Linux / Android · Your data stays on your device