Credential phishing & AiTM kits
Brand look-alikes, cloned login pages, reverse-proxy kits, Telegram and webhook exfiltration.
Built for the browser.
Where today's attacks happen: a fake login, a fake CAPTCHA, a "support" download. Enterprise-grade protection without the complexity.
Request accessIn the page.
Sensors load before any site script.
Zero-knowledge.
Alerts only your team can decrypt.
By policy.
Rolled out and updated by your IT tools.
Protection
The attacks that get past email filters and EDR.
They live in a browser tab, on a fresh domain, for a few hours. VigilSpan looks at what each page does, not just where it lives.
ClickFix & fake CAPTCHAs
Malicious commands written to the clipboard are replaced with a warning before they can be pasted, even when the instructions are an image.
Remote-access scams
ScreenConnect "guest" invites and AnyDesk or TeamViewer installers from anywhere but the vendor are blocked.
Consent & device-code phishing
OAuth apps asking for your mailbox, and "enter this code" hand-offs that hijack Microsoft 365 sessions.
Malicious downloads
Fake browser updates, HTML smuggling, double extensions and search-poisoned installers.
Tech-support scams
Full-screen scare pages, alert-box loops, back-button traps and pop-up floods are stopped in the page.
Skimmers & form grabbers
Card numbers, passwords or session cookies sent to third parties while you type.
Risky extensions
Every installed extension inventoried; known-bad or sideloaded high-risk ones disabled by policy.
Password reuse
Warns or blocks when the company password is typed into another site. Salted hashes, on the device only.
How it works
From page load to verdict, on the device.
Nothing about ordinary browsing leaves the machine to make a decision. Optional services add depth when your policy allows them.
- 1
Sense
In-page sensors run before any site script: clipboard writes, file assembly, form exfiltration, pop-ups.
- 2
Score
A local engine combines address, page, behaviour and signed threat intel into one score and a clear reason.
- 3
Ask (optional)
Borderline pages get an AI second opinion from the provider you choose, with only what your policy allows.
- 4
Act
Block, warn or log per attack type. Lower-risk blocks can be overridden with a reason your team sees.
- 5
Report
Alerts are encrypted in the browser and land in your dashboard, readable only with your keys.
Zero-knowledge by design
We built it so we can't read your data.
Browsing data is some of the most sensitive data a company has. VigilSpan's servers relay and store it, but can't open it.
- Encrypted in the browser. Alerts and history are encrypted with your organisation's public key before they leave the device.
- Your keys, your policy. Your admins hold the keys and sign every policy change. Neither we nor an attacker who breached us can change what your browsers enforce.
- Tamper-evident. Threat intel is signed and its key pinned in the extension; altered alert records fail to decrypt.
- Collect less. History is off unless you turn it on. Incognito is never sent to third parties.
AI, on your terms
A second opinion for the grey areas.
Bring your own key for Anthropic Claude, OpenAI, Azure OpenAI, Google Gemini or any OpenAI-compatible endpoint, or use ours. Your policy decides what may be sent, and every verdict is logged with its reasons.
Community threat intel
One organisation's catch protects the rest.
Unmistakable attacks are shared anonymously, confirmed, and pushed to every customer. Anything touching popular sites waits for a human. One switch turns sharing off.
Deploy
Rolled out in an afternoon, updated forever.
Installed and kept up to date by browser policy. Each device enrolls itself from the policy, with no user action.
Group PolicyWindows domains
Microsoft IntuneWindows & macOS
Google AdminChrome Enterprise
Jamf & MDMmacOS profiles
RMM / scriptsPowerShell kit
LinuxManaged policy
The dashboard's Deploy page generates every kit, for Chrome, Edge, Brave and Firefox, with your enrollment code filled in.
Getting started
From request to protected browsers.
- 01
Request access
Tell us about your organisation with the form below and we'll get back to you by email.
- 02
We create your organisation
Your owner gets a one-time setup link to app.vigilspan.com.
- 03
Secure your account
Set a password, turn on two-factor authentication, and create your organisation's encryption keys.
- 04
Choose your policy
Block, warn or log per attack type; sign-in domains; allowed and blocked sites; AI and sharing.
- 05
Deploy
One test machine first, then the kit from the Deploy page to a pilot group and on to everyone.
- 06
Watch and tune
Alerts, user reports, overrides and AI verdicts arrive as they happen. Tune with allow and block lists.
Download
The VigilSpan extension.
For Google Chrome, Microsoft Edge, Brave, Opera and Vivaldi (Chromium 116 or later), and Mozilla Firefox 140 or later.
Chrome Web StoreChrome · Brave · Vivaldi · Opera
Microsoft Edge Add-onsEdge
Firefox Add-onsFirefox 140+
The extension protects a browser once it is enrolled in an organisation. To enroll, you need an account.
Try it on one computer
- Unzip the package into a folder you'll keep.
- Open chrome://extensions (or edge://extensions) and turn on Developer mode.
- Click Load unpacked and choose the folder.
- In your VigilSpan dashboard, open Devices → Enroll this browser now.
Rolling out to a company?
Install by policy so it updates itself and enrolls without user action. Point the browser at:
https://app.vigilspan.com/ext/updates.xmlThe dashboard's Deploy page builds the full Group Policy, Intune, Google Admin, macOS and Linux kits for you.
Request access
Start a pilot.
We're onboarding organisations one at a time so every pilot gets hands-on help. Tell us about yours and we'll set up your account.
- Your own organisation and dashboard
- Help with policy and a first deployment
Prefer email? [email protected]
FAQ
Questions we get asked.
Which browsers are supported?
Google Chrome, Microsoft Edge and Brave can be deployed and kept up to date by company policy. Opera and Vivaldi install from the Chrome Web Store. Mozilla Firefox 140 or later installs from Firefox Add-ons, also by policy. Windows, macOS and Linux, managed or not.
Can VigilSpan see which sites our people visit?
No. Alerts and, if you enable it, browsing history are encrypted in the browser with your organisation's public key, and only your admins hold the private key. Our servers store ciphertext and a few plain fields needed to route alerts, such as attack type and severity.
Does it send every page somewhere to be checked?
No. Verdicts are made on the device using signed threat intel and local analysis. Reputation look-ups and AI analysis of borderline pages are optional and switched on by your policy.
What happens when a legitimate site is blocked?
For lower-risk blocks your policy can let users continue after giving a reason. You see every override in the dashboard and can allow-list the site for everyone. Conclusive threats can't be overridden.
Do we have to use AI?
No, it's off by default. If you turn it on, you can use your own provider and key, or our managed option.
How do updates reach our browsers?
Managed browsers check VigilSpan's update service every few hours and install new signed versions automatically. Threat intel and your policy refresh every 15 minutes.
How much does it cost?
Ask us and we'll send pricing for your organisation's size.