THE ENGINE
Hash matching, YARA rules, PE heuristics, entropy analysis and archive inspection — written in Rust, because a parser that reads hostile files all day should not be able to overflow a buffer.
10 · DESKTOP
American-built, Kaspersky-class endpoint security.
A memory-safe, Rust-native antivirus and threat-exposure suite for Windows — real-time protection, an encrypted quarantine vault, and breach monitoring, under US jurisdiction.
On 20 June 2024 the U.S. Commerce Department’s Bureau of Industry and Security issued its first-ever Final Determination under the ICTS supply-chain authority, banning Kaspersky products in the United States on national-security grounds tied to Russian jurisdiction.
By 20 July 2024 Kaspersky was barred from new U.S. sales. By 29 September 2024 it was barred from delivering signature and codebase updates, and from operating its reputation cloud for U.S. users.
Millions of users were left on security software that would receive no new signatures and no cloud protection, degrading to unprotected over time. Bulwark is a replacement built from first principles for that gap.
Positioning, not affiliation. Bulwark is an independent clean-room product. It is not affiliated with, derived from, or containing any Kaspersky code — "Kaspersky-class" names the target feature bar, not the implementation.
Hash matching, YARA rules, PE heuristics, entropy analysis and archive inspection — written in Rust, because a parser that reads hostile files all day should not be able to overflow a buffer.
Caught files go into an encrypted vault with a restore ledger, so a false positive is reversible rather than destructive.
Checks whether your credentials have surfaced in a known breach using k-anonymity — the password never leaves the machine, and no API key is required.
It is not a drop-in replacement for a twenty-year commercial product on day one, and does not claim to be.
Parts that genuinely require vendor infrastructure — a WHQL/EV-signed kernel minifilter, Microsoft Virus Initiative membership for Windows Security Center registration, a hosted reputation cloud, commercial malware feeds, code-signing certificates — are built up to their integration boundary and marked as such. They are never faked.
It is not code-signed yet, so Windows will warn about an unknown publisher until a certificate is in place.