STINGER SHIELD
Scam and endpoint security, with a human still in the loop.
Shield is a tenant-scoped control plane for anti-scam and endpoint security: an operator console, email authentication checks, file scanning across three real engines, encrypted quarantine custody, and a Windows endpoint service with a mobile companion.
What it does
Email authentication checks
Reads a message's own SPF, DKIM and DMARC results and marks each as pass, fail, missing or unknown, with the header it came from kept as evidence.
File scanning, three engines
A file is scanned by ClamAV, Windows Defender and YARA rules, each result kept and attributed to its own engine, not merged into one opaque score.
Encrypted quarantine custody
A flagged file is held encrypted, tenant-scoped, with a retention period; nothing is silently deleted, and release requires its own authorization check.
Approval-gated response
Nothing acts on a detection without a human confirming it, and the approval is checked against the exact tenant, actor, scope and plan it was issued for before it can run.
Windows endpoint service + mobile companion
A service that runs on the machine, paired with a mobile companion app.
Cases, from open to closed
Each detection opens a case: evidence attached, routed through approval, and tracked to quarantine.
Live event stream
The operator console shows what's happening as it happens, not on a refresh.
Role-based access
Viewer, analyst, responder, admin and owner roles, each seeing and doing only what that role is allowed: a viewer reads cases and evidence, only a responder or above can approve a response.
Firewall block, built and gated
The Windows agent can block an exact indicator at the firewall. Live blocking is switched off by default and runs as a dry run until it is turned on for a deployment.
Mobile companion
Its own mobile app, not yet on the app stores.
Shield's mobile companion is built. It shows open cases, flags anything high or critical severity, and lists approvals as review-only; it states plainly on screen that it reports only verified platform capabilities, never a guess about what the device caught. It has not yet been submitted to an app store.
Cases, from an email to an action
Submit a suspicious email
Submit a suspicious email and Shield scores it, keeps the evidence and opens a case with suggested responses.
Check against the original
Shield can check the original email against its recorded hash when original-content storage is set up, and says so plainly when it is not.
A plan, not an action
Pick a suggestion and Shield writes a scoped response plan; the plan alone does not run anything.
Approve, deny, or revoke
You approve, deny or revoke each action against the exact plan; if the approval cannot be saved, nothing continues.
A history that tells them apart
Approved actions show in a history that tells a real run from a dry run, and an interrupted run is held for review rather than repeated.
Endpoint and console
Enroll a computer
An owner or admin gets a one-time code and a Windows command to enroll a computer, which starts in watch-only mode.
The service watches, scores, reports
The Windows service watches the folders you authorize, scans new files and reports its health back to the console.
Signed, versioned updates
Updates are verified as signed and checked against version and rollout rules before they are accepted.
Reports with an honest label
Case counts by severity and state, with a clear label when the data is empty, stale or unavailable.
Sign in, connect, disconnect
Connect a workspace, switch or disconnect, log out, or request account deletion.
What Annabelle can do here
Nine tools, a human confirms the rest
Annabelle can list cases and evidence and request a response; approving, denying, revoking or running an action always needs you to confirm.
Where it stands
In development, invite-only.
Shield is being built out and is not yet a general customer-facing release.