Vigil

What the company appears to be: The project described as "Vigil" (also referred to as ZMT) is a self-reported passive network monitoring tool built on Zeek telemetry. It aims to provide real-time visibility into network activity by learning normal behavior and flagging anomalies, with optional AI-powered explanations.

What changed: The author states they used AI tools like Codex and GPT-5.6 throughout development to help build an end-to-end system, design a lightweight ML approach, make the product demonstrable, add responsible AI features, and improve delivery quality.

Single most important open question: Is there any evidence of actual deployment or usage beyond the author's own demonstration setup?

The description states that Vigil (ZMT) is:

• A passive monitoring tool for networks the user owns or is authorized to observe
• Built using Zeek conn.log metadata
• Streaming telemetry via FastAPI receiver with WebSocket ingestion
• Maintaining live metrics and displaying activity in a browser dashboard
• Learning a lightweight baseline from time of day, destination port, byte volume, and protocol
• Combining that score with transparent rules for unseen source/port combinations and traffic-rate bursts
• Providing explanations for flagged events through optional OpenAI integration

The system architecture includes:

• Zeek sensor -> Python sender (tails conn.log) -> WebSocket ingestion endpoint
• Bounded async queue -> parser + GeoIP enrichment + online usage model
• Live metrics / event broadcast / dashboard
• Optional OpenAI explanation endpoint

Evidence: The author's own write-up describes the tool's functionality and architecture in detail.

Inference: This appears to be a proof-of-concept or prototype rather than a commercial product, based on the single-member team and demo-only nature described.

The description states:

• The tool aims to make network visibility understandable for small teams and home-lab operators
• It addresses problems with raw connection data being difficult to interpret
• Existing security tools are described as expensive, noisy, or specialist-focused
• The solution provides "explainable" anomaly detection without requiring a full security operations center
• It shows why an event was flagged and suggests next investigation steps

Evidence: Self-reported claims about problem/solution fit and positioning.

Inference: The positioning appears to be toward non-specialist users seeking basic network monitoring capabilities, but lacks evidence of market traction or customer validation.

The description states:

• Small teams and home-lab operators
• Users who own or are authorized to observe networks
• Those who can collect network logs but struggle with interpretation

Evidence: The author's own description of target users.

Inference: No evidence provided about specific customer segments, personas, or actual user base.

The description does not contain any information about:

• Revenue model
• Pricing structure
• Monetization strategy
• Customer acquisition costs
• Unit economics

Evidence: Not evidenced.

The description states:

• Built with JavaScript, Python, Zeek
• Uses FastAPI WebSocket receiver with separate sender and dashboard routes
• Bounded ingestion queue and asynchronous processing
• Zeek sender that tracks file position and handles log rotation
• Dependency-light online Gaussian baseline using incremental running statistics
• Explainable anomaly fields: model score, confidence, burst/novelty reason, normal-versus-suspicious label
• Optional GeoIP map, reconnecting frontend, and deterministic showcase scenario
• API-key gate, origin allowlist, and server-side secret handling
• OpenAI integration with constrained prompt design

Evidence: The author's own technical description of the system.

The description states:

• Single-member team (Gaurav Sharma)
• Demo mode that creates synthetic traffic for evaluation
• No mention of customers, revenue, or adoption
• Project submitted to OpenAI 2026 hackathon
• Future development plans include persistence, evaluation against labeled data, alert routing, etc.

Evidence: The author's own account of project maturity and future roadmap.

Inference: No evidence of traction, revenue, or customer base beyond the author's own use case.

The description does not contain any information about:

• Competitors
• Market size
• Competitive advantages
• Differentiation from existing tools

Evidence: Not evidenced.

Key risks identified from the self-reported description:

1. Single-person team - No evidence of scaling capability or dedicated support
2. Demo-only functionality - No evidence of real-world deployment or production use
3. No revenue or customer data - No traction signals beyond author's own demonstration
4. AI integration risks - Optional OpenAI feature raises questions about data handling and liability
5. Limited scope - Focus on passive monitoring only, no indication of broader security platform ambitions
6. Unverified claims - All descriptions are self-reported without external validation

Evidence: Self-reported account of project scope and limitations.

1. What is the actual usage context for this tool beyond the demo?
2. Are there any real-world deployments or pilot programs currently running?
3. How does the team plan to scale from a single developer to support broader market needs?
4. What are the specific use cases where customers would pay for this functionality?
5. How do you plan to handle data privacy and compliance issues with network monitoring?
6. What is the roadmap for moving beyond demo mode to production-ready features?
7. Are there any partnerships or integrations planned with existing security tools?