Frequently asked questions

Yes. Free and open source under GPL-3.0-or-later. No account, no paywall, no premium tier. Copyleft keeps a security tool auditable by the people who depend on it.

No. WinSight is a read-only visibility and triage suite. It does not claim to be antivirus or EDR, and does not guarantee detection of kernel rootkits, memory-only implants or every persistence technique. It complements Windows Defender rather than replacing it.

No telemetry, no analytics, no account. The only outbound connection is an explicit, user-initiated VirusTotal hash lookup: a SHA-256 hash, never file contents. It is disabled by default and requires your own API key.

Released binaries are not yet Authenticode-signed: the project holds no code-signing certificate, so SmartScreen shows an unknown-publisher warning. Verify integrity yourself: every release ships SHA-256 checksums, an SBOM and GitHub build provenance.

Windows 11 and Windows 10 22H2 (build 19045+), on x64 and Arm64, while supported by Microsoft. 32-bit Windows and out-of-lifecycle builds are intentionally rejected.

No. The default install is per-user under %LOCALAPPDATA% and requests no elevation. Only the optional firewall service and some live monitors (like DNS ETW) require an elevated console.

The firewall service is not even installed by default, and when you do install it, it starts audit-only, observing, not blocking. Nothing is filtered until an elevated operator explicitly arms enforcement through the dashboard.

Same spirit (small, single-purpose, free, open-source security tools) but for Windows instead of macOS. WinSight also adds write attribution, per-process drill-down and physical-access detection, which have no macOS counterpart.

That is exactly the role WinSight's outbound firewall plays: free, open-source, per-application block/allow enforced at the Windows Filtering Platform kernel layer. It starts audit-only (observing what would be blocked) until an elevated operator arms it.

Autoruns lists autostart entries and leaves the judgment to you. WinSight scans 22 autostart families with catalog-aware Authenticode verdicts, optional VirusTotal enrichment, a live Guardian alert the moment a new startup item appears, and write attribution that names the program which created it.

It detects, it does not block. The opt-in ransomware feature plants hidden decoy files and watches for rename/delete bursts and high-entropy writes, then alerts you. Stopping a process mid-encryption would need a signed kernel minifilter WinSight does not ship. What it does instead is tell you whether Windows' own kernel-level blocker is on: the integrity check reads Microsoft Defender's Controlled Folder Access posture and flags it when it is disabled, in audit mode, only covering disk modification, or configured on while Defender is not actually enforcing. If a different antivirus is running, WinSight names it from the Windows Security Center and says so is normal, while stating that it cannot read that product's own ransomware protection, so you must confirm it yourself. WinSight reports and links to Windows Security; it never changes the setting for you. Keep backups.

WinSight's camera & mic monitor shows current and historical Capability Access usage per process (which app turned the mic on, and when) plus live transitions with winsight av --watch.

Yes. winsight mcp runs a local, read-only MCP server over stdio for MCP-compatible AI clients. No network listener, summary-only by default, with user-profile paths redacted unless you enable the sensitive-evidence gate.

Through the normal Windows uninstaller. If you enabled ransomware protection, turning it off removes its decoy files. If you installed the firewall service, remove it first with winsight-firewall-service.exe uninstall from an elevated console.