FIM for Windows, in one .exe
You download one file and run it. There is no agent, no service and no web console.
It records the folder you point it at. Then it reports which files gained a power they never had: run a command, reach the network, read saved passwords, start after a reboot.
Set it up
Open PowerShell. The installer checks the published sha256 before it runs the binary, and the installer source is on the site.
irm https://vigihq.com/install.ps1 | iex vigi setup
vigi setup asks which folder to watch. Then it installs a scheduled check. The machine owns that job, so it contacts no server for instructions.
Check an update before it lands
Most Windows software arrives as an installer you run once. Hand Vigilance the version you already trust and the new one.
vigi diff --old C:\apps\thing-4.2 --new C:\downloads\thing-4.3
Read a single installer before you run it.
vigi whatis --artifact C:\downloads\setup.msi
Vigilance opens MSI, CAB, 7z, xar, ISO and squashfs with its own readers, so a change hidden inside a package is still a finding. A format it cannot open yet is a loud finding, never a silent pass.
What it flags on a Windows machine
Vigilance reports each of these:
- A file that arrives able to act.
- A file whose code now points at a new address.
- A compiled program that now calls the system in new ways.
- A file dropped at a name that runs by itself.
- A shortcut repointed outside its folder.
- A deleted install or policy file.
- A permission change that alters no bytes.
- A file that arrived, ran, and deleted itself between two checks.
On a normal update it stays quiet. A file that already held a power is normal.
Next to the FIM you already run
An agent-based FIM watches a live machine all day. It records who touched a file. Vigilance answers a different question. Can you trust this version? Most teams keep both.
Side by side with CrowdStrike FileVantage, Qualys FIM, Tripwire and Wazuh.
Known risk versus new risk
A bug or a bad package someone already reported, with a name and a number. Most tools work here.
A file that gained a power it never had, that no report covers yet. Vigilance works here.
Common questions
How do I set up file integrity monitoring on Windows?
Download one .exe with the PowerShell line above. Then run vigi setup and pick the folder to watch. Vigilance records the folder and installs a scheduled check. There is no agent and no service.
Does it need administrator rights?
No, for a folder your account can read. A machine-wide scheduled check under a system path needs an elevated PowerShell, the same as any scheduled task.
Can it read inside an MSI before I install it?
Yes. Vigilance opens MSI, CAB, 7z, xar, ISO and squashfs with its own hand-written readers. A format it cannot open is a loud finding, never a silent pass.
Is this a replacement for CrowdStrike FileVantage or Qualys FIM?
It answers a different question. Those tools watch a live machine all day and record who touched a file. Vigilance checks a version before you trust it and names the power a file gained. Many teams run both.
Does it send my files anywhere?
Pro opens no network connection at all and works on an air-gapped machine. Free posts a signed report of each run: file hashes and powers found, never the code and never a path or file name.
Try it on your own software.
Show it the version you run today and the one you are about to install.
Talk to us
A question, a pilot, or a bigger fleet? Send a note. It reaches a person.