The week that pushed me to build it
This week, Europe's cybersecurity news read like a disaster log:
- PHP2Shell — a critical vulnerability (9.2/10) actively exploited in the wild. Researchers confirmed attackers were using it days before it was publicly disclosed.
- Belgium — the federal tax websites (MyMinfin, Tax-on-Web, Biztax) were knocked offline October 28–31 by a cyberattack. The filing deadline had to be extended to November 16.
- Thegentlemen — a ransomware group claimed victims in Germany, Sweden, and Italy in the same week.
Most people hit by attacks like these don't find out until their files are encrypted and someone's demanding payment. I wanted to build something for the everyday user — the person who finds big security suites confusing and just wants to know the moment something's wrong. That became VigilShield.
What it does
VigilShield is a lightweight Windows program (Python, single .exe):
- Real-time network watch. Every outbound connection is checked against a threat list of known malicious servers. The list updates from public threat-intelligence feeds (abuse.ch URLhaus and Feodo Tracker, FireHOL blocklists).
- Automatic blocking. On a match, it kills the offending connection and blocks the server in Windows Firewall via netsh. Every rule it creates is tagged, and one button removes them all.
- Instant red alerts. A big, unmissable warning window with sound the moment a threat is stopped — what was blocked, when. No silent failures.
- Suspicious program detection. Heuristics for programs launching from temp folders with disguised names (double extensions, random-looking names).
- Ransomware tripwires. Hidden canary files in Documents and Desktop. If something starts mass-modifying files, you get warned fast.
- Exposure scan. A plain-language report of where the PC is exposed right now — firewall off? risky ports open (RDP 3389, SMB 445)? protection disabled? — so users can fix things before attackers come.
Design choices I'm deliberately proud of: quarantine moves files instead of deleting them. Nothing is irreversible. It runs as admin for auto-blocking, but degrades gracefully to watch-and-warn without admin rights instead of crashing.
What it does NOT do (the honest section)
I'll say this louder than the features, because trust is the whole product in security software:
- It cannot predict an attack before it starts. Nobody's software can — not mine, not the billion-dollar suites'. Anyone who promises prediction is lying.
- It is not an antivirus replacement. Keep Windows Defender (free, built into Windows) turned on. VigilShield is a second pair of eyes that works alongside it.
- It does not stop 100% of attacks. It blocks known threats fast and flags suspicious behavior. That catches the common, everyday attacks — which is most of what hits home users.
I put these limits in the UI itself, the README, and the sales page. If that costs me sales, good — the wrong customers are worse than no customers for a security tool.
The hard part isn't the code
Technically this was a few days of Python (psutil, tkinter, pystray, netsh). The hard part is trust: why would anyone give deep system access to software from a maker they've never heard of? My answer so far: radical honesty about limits, reversible everything, no subscription, no account, no phoning home, $19 one-time.
If you've shipped in a high-trust category, I'd love to hear how you earned your first users. And if you're technical — tear apart the detection logic. That's the feedback I actually need.
VigilShield is $19 one-time: https://haiderz03.gumroad.com/l/vigilshield — https://vigilshield.pages.dev/ . Windows 10/11. The ad video: https://youtube.com/shorts/RTHdX1eC0fM
Top comments (0)