ThreatVector · TommyGun

Download TommyGun free for Windows.

The app and the entire scan library are free. You only pay when you run a scan and want the report. There is no trial clock, no account to create, and no card required to install it.

Release status — updated 6 September 2026

Version 1.0 is finished. We are not handing it to you unsigned.

TommyGun 1.0 has been built, tested and field-run. The last step before we publish the installer is an Extended Validation code-signing certificate — the thing that makes Windows show our company name instead of “Unknown publisher” when you run it. That certificate is issued against a verified legal entity and ours is in progress.

We could ship today and tell you to click past the SmartScreen warning. A security company that trains you to ignore security warnings is not a security company. So the download opens the day the certificate lands. Leave your email and you will be the first to know — one message, no marketing list.

The honest version

What “free” covers, and what it does not.

Free: the app

The TommyGun launcher, the guided wizard, the whole scan library and every future update. Install it on as many of your own Windows machines as you like.

Free: looking around

You can open the Scan Locker, read what every scan checks, see what it will ask you for and read its consent screen — all before spending anything. Nothing in the app is hidden behind the purchase.

Paid: the report

Producing an analysed, written report is the paid step, from $19. A single purchase covers three runs of that scan — first look, post-fix follow-up and final verification — for a year from your first run.

Optional: quarterly plans

Quarterly checkups are the only recurring subscription we sell. Every other product is a one-off purchase. Nothing auto-renews unless you chose a quarterly plan.

System requirements

What you need to run it.

Windows 10 or 11, 64-bit

TommyGun ships as a single installer with everything bundled. You do not need Python, a package manager or any developer tooling installed.

Administrator rights for some scans

Checks that read your computer’s own security settings need to run elevated. The wizard tells you which scans those are, and why, before it starts — never after.

An internet connection

Needed to check your purchase, to look up current threat reference data, and to send the results for analysis. The scan itself runs locally on your machine.

The email you bought with

You sign in through your normal browser using the Shopify account from your order. TommyGun stores no store password and no payment details on your computer.

Installing

Four steps, once.

01

Run the installer

Download and run it. Windows will show our verified publisher name in the prompt — if it shows anything else, you did not get the file from us.

02

Sign in once

TommyGun opens your browser, you sign in to your store account, and the app is paired to that machine. No password is typed into the app itself.

03

Your scans appear

Anything you have already bought unlocks automatically. Everything else stays visible and dimmed, with a link to the store.

04

Run your first scan

Pick a scan, work through the wizard, and the report arrives by email. Most single scans take under ten minutes.

Why the wait

What code signing is, and why we care about it.

When you download any Windows program, Windows checks whether it carries a cryptographic signature naming a verified company. Unsigned software triggers the blue “Windows protected your PC” screen, and the only way past it is to click More info → Run anyway.

It proves who wrote it

A signature ties the installer to a legal entity that a certificate authority has verified. If someone else distributes a modified TommyGun, it will not carry our signature.

It proves nothing changed

The signature breaks if a single byte of the installer is altered after we built it — which is exactly what a supply-chain attacker would need to do.

Teaching people to click through warnings is the attack

“Ignore that warning, it’s fine” is how a great deal of malware gets installed. We are not going to be the company that teaches you that habit.

Questions

Download questions

As soon as our Extended Validation code-signing certificate is issued. It is a verification process run by a certificate authority against our registered company, so the date is not entirely ours to set. Leave your email above and you will get one message the day it goes live.

No. An unsigned installer from a company you have not bought from yet, for software whose whole job is security, is exactly the file you should refuse to run. We are not going to ask you to make an exception for us.

Not at launch. TommyGun 1.0 is Windows 10 and 11, 64-bit. Several individual scans check Linux servers, cloud storage, websites and email domains from a Windows machine, so you do not need Linux to check Linux.

No. TommyGun is not an antivirus and installs no background service, driver or startup task. It runs only while you have it open and are running a scan.

Individual scans start at $19. Multi-scan packs and full-service bundles cost more and cover more ground. Every one-off purchase includes three runs over a year. Quarterly plans are the only subscription and are entirely optional.

You need the account you check out with — that is what your purchases are attached to. There is no separate TommyGun account, login or licence key to keep track of.

Ownership and attribution

TommyGun is developed by ThreatVector LLC.

Reporting mechanisms and cybersecurity customer service are powered by ThreatVector LLC.

ThreatVector and its scan library are developed, sold and distributed by ThreatVector LLC.

Downloading and installing TommyGun means you accept our Terms of Service — including the requirement to run scans only against systems you own or are authorised in writing to test.

While you wait

See exactly what you would be downloading.

Every screen of the app, and the anatomy of the report it produces — before you install anything.

See the demo What TommyGun does