A file integrity check that names the one file that matters
File integrity monitoring tells you that a file changed. A normal update changes hundreds of files, so the list tells you nothing.
Vigilance reads the change and reports what the file can now do that it could not do before. It runs on your own machine as one file.
What file integrity monitoring does
A file integrity checker records a fingerprint of each file you care about. It reads the files again later. Then it reports the ones whose fingerprint no longer matches. That answers one question: did this file change. It is the right question for a machine that must not change.
It is the wrong question for software you update. Every update changes files on purpose. A poisoned update changes the same files, plus one more, and the fingerprint check treats all of them the same way.
Where a file integrity checker stops
A file integrity checker leaves three gaps.
The list is too long to read. One package update can change several hundred files. A tool that reports all of them buries the one that matters.
A new file has no fingerprint. Classic FIM compares against a record. A file that arrives for the first time has no record, so it passes as normal. That is how most attacks arrive.
Nothing says what the change lets the file do. A comment edit and a new line that steals your saved passwords both appear as "changed".
What Vigilance adds
Vigilance still does the fingerprint work. It also reads each changed file. Then it names the powers that file holds now: run a command, reach the network, read saved passwords, or survive a reboot.
If a file held a power before the update, Vigilance stays quiet. If a file gained a power it never had, Vigilance flags the file and shows the lines that gave the power. There is no rule file to write first, no reputation list, and no AI.
| Question | Classic FIM | Vigilance |
|---|---|---|
| Tells you a file changed | Yes | Yes |
| Tells you what the change lets the file do | No | Yes |
| Flags a brand-new file with no record | No | Yes |
| Needs a policy or rule file written first | Usually yes | No |
| Stays quiet on a normal update | No, it lists every file | Yes |
| Looks inside a zip, a package or a container | Not its focus | Yes |
| Checks a release before you install it | No | Yes |
| Needs an agent or a server | Often | No, one file |
Run a file integrity check in two commands
Install the binary. Then point it at a folder. Vigilance records the folder on the first run. It reports changes on every run after that.
curl -fsSL https://vigihq.com/install.sh | sh vigi setup
On Windows, use PowerShell.
irm https://vigihq.com/install.ps1 | iex vigi setup
To check an update before you trust it, hand Vigilance both versions.
vigi diff --old ./version-you-run --new ./version-you-are-about-to-install
Ask what a single file can do, before you run it.
vigi whatis --artifact ./installer.msi
The full command list is in the docs. You can run a real check in your browser on the sandbox, with no install.
Known risk versus new risk
A bug or a bad package someone already reported, with a name and a number. Most tools work here.
A file that gained a power it never had, that no report covers yet. Vigilance works here.
File integrity monitoring tools, side by side
Each page below sets Vigilance against one tool, in a plain table.
Tripwire, AIDE on Linux, Wazuh, Qualys FIM, CrowdStrike FileVantage, FIM for Windows, and every other comparison.
Many teams keep the FIM they have and run Vigilance next to it. The FIM watches the machine all day. Vigilance checks the update before it lands.
109 attacks that a fingerprint check lists and buries
Each attack on the attacks page shipped as a normal update from a source people trusted. In each one, a file gained a power it never had. The rest of the release was genuine.
Common questions
What is file integrity monitoring?
File integrity monitoring, or FIM, records a fingerprint of each file you care about. It reads them again later and reports the ones whose fingerprint changed. It answers one question: did this file change since the last look.
What is the difference between a file integrity checker and Vigilance?
A file integrity checker reports that a file changed. Vigilance reads the change. Then it reports what the file can do now and could not do before: run commands, reach the network, read saved passwords, survive a reboot.
Is Vigilance a file integrity monitoring tool?
Yes. It records a folder, reads it again on a schedule, and reports the changes. It adds one thing that classic FIM tools do not: it names the power a file gained.
Does file integrity monitoring work on Windows?
Yes. Vigilance runs on Windows, macOS, Linux, FreeBSD, OpenBSD and NetBSD as one file, with no agent and no service to install. See FIM for Windows.
Is there a free file integrity monitoring tool?
Yes. The Free plan costs nothing and every command works. It runs online and posts a signed report of each run. Pro costs $99 per month flat for the company and opens no network connection at all.
Why does FIM produce so much noise?
A normal software update changes hundreds of files. A fingerprint check flags all of them, so a real attack sits inside a long list nobody reads. Vigilance stays quiet on the normal files and flags the few that gained a power.
Try it on your own software.
Show it the version you run today and the one you are about to install.
Talk to us
A question, a pilot, or a bigger fleet? Send a note. It reaches a person.