Blanktick

Blanktick is a free, AGPL-licensed security checkup for Windows that runs entirely on the device it checks. The build enforces that it has no networking code: a bytecode gate fails the build if any Blanktick class or runtime dependency references a networking API, so it cannot send telemetry or phone home. It audits device posture (encryption, firewall, updates, persistence, installed software, USB, AI-agent and MCP configuration), checks passwords and links against offline breach and blocklist data, and offers an opt-in live-protection sensor that flags behaviours such as Office spawning a shell, ransomware-style mass writes, C2 beaconing and DNS tunnelling. Its core rule is that a check it could not run is reported as not checked, never as a pass. It is built for people who cannot or should not trust a cloud security product with data about their machine.