Enterprise browser security · Chrome & Edge

Stop the attack inside the page, before anyone clicks twice.

Phishing kits, fake CAPTCHAs that make people paste commands, "support" scams that install remote-control tools: today's attacks happen in the browser. VigilSpan watches what each page actually does and stops it on the spot, then reports to a dashboard only your team can decrypt.

Request a pilot Download the extension
  • Deploys by Group Policy, Intune, Google Admin or MDM
  • Users enroll themselves, with zero clicks
  • End-to-end encrypted reporting

Blocked by VigilSpan

ClickFix: fake CAPTCHA

  • Hidden command slipped onto the clipboard: neutralised
  • Copy-paste-and-run instructions on an unknown domain
  • Domain registered 3 days ago
Risk
97
In the pageSensors load before any page script runs
On the deviceVerdicts are made locally, in milliseconds
SignedThreat intel and your policy are cryptographically signed
EncryptedAlerts readable only with your organisation's keys

What it stops

The attacks that get past email filters and EDR

They live in a browser tab, on a fresh domain, behind a CAPTCHA, for a few hours. VigilSpan looks at what the page does, not just where it lives.

Credential phishing & AiTM kits

Brand look-alikes, cloned login pages, reverse-proxy kits (Evilginx-style), Telegram and webhook exfiltration, victim emails in the URL.

ClickFix, FileFix & fake CAPTCHAs

Malicious commands written to the clipboard are replaced with a warning before the user can paste them, even when obfuscated.

Remote-access scams

ScreenConnect "guest" invites, AnyDesk or TeamViewer installers from anywhere but the vendor: blocked unless it's your IT's own server.

Browser-in-the-browser

Fake sign-in pop-ups drawn inside the page to steal Microsoft, Google or Okta credentials.

Consent & device-code phishing

OAuth apps asking for mailbox or file access, and "enter this code" hand-offs that hijack Microsoft 365 sessions.

Malicious downloads

Fake browser updates, HTML smuggling, double extensions, drive-by and search-poisoned installers.

Tech-support scams & lockers

Fullscreen scare pages, alert-box loops, back-button traps and pop-up floods are stopped in the page.

Skimmers & form grabbers

Card numbers, passwords or cookies sent to third parties while you type: Magecart-style injection on real sites.

Risky extensions

Inventory and risk-scoring of every installed extension; disable known-bad or high-risk ones automatically.

Corporate password reuse

Warns or blocks when someone types the company password into another site. Only salted hashes, only on the device.

QR-code phishing

QR codes in Outlook, Gmail and other webmail are decoded and checked before anyone scans them with a phone.

Malvertising & local-network attacks

Ad click to look-alike chains, redirect chains, pop-unders, and public sites probing your router or localhost.

How it works

From page load to verdict, on the device

Nothing about ordinary browsing leaves the machine to make a decision. Optional services add depth when your policy allows them.

  1. 1

    Sense

    In-page sensors run before any site script: clipboard writes, file assembly, form exfiltration, pop-ups, smart-contract loaders.

  2. 2

    Score

    A local engine combines URL, page, behaviour and signed threat intel into one risk score and a clear reason.

  3. 3

    Ask (optional)

    Borderline pages can get an AI second opinion from the provider you choose, with only the content your policy allows.

  4. 4

    Act

    Block, warn or log, per attack type. Lower-risk blocks can be overridden with a stated reason that your team sees.

  5. 5

    Report

    Alerts are encrypted in the browser and land in your dashboard, readable only with your organisation's keys.

Zero-knowledge by design

We built it so we can't read your data

Browsing data is some of the most sensitive data a company has. VigilSpan's servers relay and store it, but can't open it.

  • Encrypted in the browser. Alerts and history are encrypted with your organisation's public key before they leave the device. We store ciphertext.
  • Your keys, your policy. Your admins hold the keys and sign every policy change. Neither we nor an attacker who breached us can change what your browsers enforce.
  • Tamper-evident. Threat intel is signed and its key is pinned in the extension. Alert metadata is bound to the ciphertext, so altered records fail to decrypt.
  • Collect less. History collection is off unless you turn it on. Incognito is never sent to third parties. Shared community data never includes query strings.

AI, on your terms

A second opinion for the grey areas

Bring your own key for Anthropic Claude, OpenAI, Azure OpenAI, Google Gemini or any OpenAI-compatible endpoint, or use ours. Your policy decides what may be sent: signals only, page text, or text plus script excerpts.

Every AI verdict and its reasons are logged in your dashboard, so you can see exactly why a page was flagged.

Community threat intel

One organisation's catch protects the rest

When a browser sees an unmistakable attack, its domain or URL is shared anonymously, through a keyed hash of the organisation. Confirmed attacks are pushed to every customer, and anything touching popular sites waits for a human review.

Sharing is on by default and one switch turns it off.

Deploy

Rolled out in an afternoon, updated forever

The extension is installed and kept up to date by browser policy, straight from VigilSpan. No web store, no user action. Each device enrolls itself from the policy.

Group PolicyWindows domains
Microsoft IntuneWindows & macOS
Google AdminChrome Browser Cloud Management
Jamf & MDMmacOS configuration profiles
RMM / scriptsPowerShell kit included
LinuxManaged policy JSON

The dashboard's Deploy page generates every kit with your enrollment code already filled in.

Getting started

From request to protected browsers

  1. 01

    Request access

    Tell us about your organisation with the form below and we'll get back to you by email.

  2. 02

    We create your organisation

    Your owner gets a one-time setup link to app.vigilspan.com.

  3. 03

    Secure your account

    Set a password, turn on two-factor authentication, and create your organisation's encryption keys. Keep the recovery code offline.

  4. 04

    Choose your policy

    Block, warn or log per attack type; protected sign-in domains; allowed and blocked sites; AI and sharing options.

  5. 05

    Deploy

    Start with one test machine, then push the kit from the Deploy page to a pilot group and on to everyone.

  6. 06

    Watch and tune

    Alerts, user reports, overrides and AI verdicts arrive in your dashboard as they happen. Tune with allow and block lists.

Download

The VigilSpan extension

For Google Chrome and Microsoft Edge (version 116 or later). The same signed build your managed browsers receive.

Versionlatest
Extension ID—
Download package (.zip) Signed .crx

The extension protects a browser once it is enrolled in an organisation. To enroll, you need an account.

Try it on one computer

  1. Unzip the package into a folder you'll keep.
  2. Open chrome://extensions (or edge://extensions) and turn on Developer mode.
  3. Click Load unpacked and choose the folder.
  4. In your VigilSpan dashboard, open Devices → Enroll this browser now.

Rolling out to a company?

Don't hand out the zip. Install by policy so it updates itself and enrolls without user action. Point the browser at:

https://app.vigilspan.com/ext/updates.xml

The dashboard's Deploy page builds the full Group Policy, Intune, Google Admin, macOS and Linux kits for you.

Request access

Start a pilot

We're onboarding organisations one at a time so every pilot gets hands-on help. Tell us a little about yours and we'll set up your account.

  • Your own organisation and dashboard
  • Help with policy and a first deployment

Prefer email? hello@vigilspan.com

We use these details only to reply to you. See our privacy policy.

FAQ

Questions we get asked

Which browsers are supported?

Google Chrome and Microsoft Edge, version 116 or later, on Windows, macOS and Linux, managed or not.

Can VigilSpan see which sites our people visit?

No. Alerts and (if you enable it) browsing history are encrypted in the browser with your organisation's public key, and only your admins hold the private key. Our servers store ciphertext and a few plain fields needed to route alerts, such as attack type and severity.

Does it send every page somewhere to be checked?

No. Verdicts are made on the device using signed threat intel and local analysis. Two things are optional and switched on by your policy: domain look-ups against third-party reputation services, and AI analysis of borderline pages with the content level you choose.

What happens when a legitimate site is blocked?

For lower-risk blocks your policy can let users continue after giving a reason, such as "this is a site we use". You see every override in the dashboard and can allow-list the site for everyone. Conclusive threats, like known-malicious sites, can't be overridden.

Do we have to use AI?

No, it's off by default. If you turn it on, you can use your own provider and key, so page content goes to your provider under your agreement, or our managed option.

How do updates reach our browsers?

Managed browsers check VigilSpan's update service every few hours and install new signed versions automatically. Threat intel and your policy refresh every 15 minutes.

How much does it cost?

Ask us and we'll send pricing for your organisation's size.