StopRansomware Probe · Free
Free ransomware exposure assessment for Windows.
See how exposed your Windows system is to ransomware attack paths. Portable Windows software — not hardware, not a persistent agent. One executable, download and run: read-only, no installation, nothing left behind, and the report never leaves your machine unless you send it.
Free download · Windows
Enter your business email to get the signed build. Read-only, no installation, and the report stays on your machine.
How it works
From download to answers in minutes.
- 01
Download & run
One portable executable, no installation, no extra infrastructure. It starts in seconds and runs with your current user rights — administrator is optional, for deeper coverage.
- 02
Read your report
The assessment takes from under a minute to a few minutes, then writes a local HTML report: your Exposure Score, prioritized findings, explanations and possible attack routes.
- 03
Optional: free expert review
If you want expert eyes on the results, export the sanitized package and send it to us for a free expert review of your sanitized results. A security engineer tells you what matters — no obligation.
What it checks
The conditions ransomware actually uses.
Probe looks for the configuration weaknesses — and the combinations of them — that enable initial access, credential theft and lateral movement on a Windows system and the part of the local network it can see. Findings describe reachability from the assessed endpoint and its visible network: they do not, by themselves, prove exposure to the Internet, and systems in other VLANs, branch offices, cloud environments or remote locations are outside the view of a single assessment.
Windows & Defender protections
Whether the built-in protections are enabled, reporting healthy and configured as expected.
Windows Firewall
Profile status and the openings that matter.
RDP, SMB & other reachable services
RDP, SMB and other services reachable from the assessed system and its visible local network.
SMB signing & relay conditions
Configurations that make credential relay attacks possible.
Legacy protocols: LLMNR, NBT-NS, NTLM
Old mechanisms that quietly hand attackers credentials.
LSASS protection & Credential Guard
How well the system defends the credentials in memory.
Risky service permissions
Windows services that a low-privileged user could hijack for escalation.
Backup components in sight
Backup software it can detect — and, honestly, the limits of what it can verify.
Reachable systems on the local network
What else answers from this machine — the lateral-movement surface.
Combined attack-path conditions
Findings that are individually minor but form a route when chained.
Probe can see which backup components are installed. Whether those backups would actually survive an attack — and come back — is a separate question no scanner answers on its own: Why Tested Backups Decide Everything →
What you get
A report that tells the truth — including about itself.
Exposure Score
One number summarizing how exposed this system is to ransomware attack paths — with the coverage level stated alongside it.
Prioritized findings
What was found, ranked by real-world impact — not an alphabetical wall of warnings.
Explanations & recommendations
For each finding: what it means, why it matters, and what to change.
Attack routes — honestly labeled
Possible paths separated into confirmed, conditional and incomplete. No dramatization.
A local HTML report
Generated on your machine, readable in any browser, yours to keep.
A sanitized export — optional
A cleaned package you can choose to send us for a free expert review of your sanitized results. Nothing is sent unless you send it.
Your data stays yours
The assessment runs locally and the report is written to your disk. Nothing is uploaded automatically — no telemetry account, no cloud sync. The only thing that can leave the machine is the sanitized export package, and only because you chose to send it.
Honest boundaries
What Probe is not.
Not an antivirus, EDR or SIEM
It does not monitor continuously, inspect traffic in real time, or promise to detect active malware. It assesses exposure — the conditions attacks need — not the attacks themselves.
A snapshot, not surveillance
The report is a point-in-time photograph of your exposure — and a good score means fewer visible attack conditions, not proof that a system is safe from ransomware. Systems drift: re-run it after changes, or move to continuous protection when ready.
Not the full Security Checkup
Probe is an automated pre-assessment of one system and its visible network. The free Security Checkup is our engineers analyzing your whole environment — network, endpoints and mobile.
Transparent about its limits
Every report states its coverage level and lists the checks that could not be performed — so a clean-looking result is never mistaken for a complete one.
Found something concerning in your report? Send us the sanitized export for a free expert review of your sanitized results — and if the findings run deeper than one machine, the free Security Checkup maps your whole environment.
FAQ
Is it safe to run on a production machine?
Probe is read-only by design: it inspects configuration, it does not change it. It installs no services, alters no policies, and does not remain active after you close it. Like any assessment tool, run it first on a machine and at a time of your choosing.
Do I need administrator rights?
No — the first assessment runs with the rights of the current user. Running it as administrator is optional and unlocks checks that require higher privileges; the report always tells you which checks could not be performed, so coverage is never silently overstated.
What data leaves my computer?
Nothing, automatically. The assessment runs locally and the report is written to your disk. If you want our engineers to look at it, you can export a sanitized package and send it to us yourself — that is the only way data leaves the machine.
Is it really free? What is the catch?
Really free, and useful on its own. The honest business logic: some of the people who see their exposure will want help fixing it — that is where our Security Checkup and managed services come in. We ask for a business email to send you the build, but there is no account to create, no trial timer and no upsell wall in the report.
Why do you ask for a business email?
Three reasons: to send you the signed build, to reach you if we ever re-sign or patch it for a security reason, and — because Probe is a security tool — to keep casual misuse down and confirm authorized use. The assessment itself still runs entirely on your machine; your report and your findings never reach us unless you choose to send the sanitized export.
Ten minutes from now, you could know.
Enter your business email, download Probe, run it, read your Exposure Score. Free, read-only, and the report stays on your machine.
No trial timer. No upsell wall. Your report stays on your machine.