Vigilance vs Aikido
Aikido. Runs many scanners in one cloud platform and scores your code, packages and cloud setup against known bugs. Vigilance finds the update that gained a hidden power, before you install it.
The Catch Aikido Cannot Make
Aikido scores packages in its cloud against reports that already exist. It reads the public package, not the build on your disk. Vigilance reads the build on your own disk. It compares the version you trust with the version you install. It reports any file that can suddenly do more.
A real one: axios, March 2026
axios is one of the most-installed packages on the internet. In release 1.14.1, its package.json gained a hidden install step. That step pulls down a remote-control program. A cloud scanner scores the published package, not the build on your disk. One command sees it:
vigi diff --old ./axios-1.14.0 --new ./axios-1.14.1
HEADS UP. 1 file changed. package.json can now run a hidden helper on install and reach the network.
Run both. Aikido checks the package as published. Vigilance reads the build that actually lands on your disk. See them side by side below.
Side by Side
| Question | Aikido | Vigilance |
|---|---|---|
| Checks a public npm or PyPI package | Yes | Yes, once it is on disk |
| Blocks a bad package at the pull request | Yes | No |
| Covers software that did not come from a public place | No | Yes |
| Covers a vendor file drop, an installer or a zip | No | Yes |
| Covers your own build output | No | Yes |
| Runs on the machine after install, not just in CI | No | Yes |
Which One Do You Need?
They overlap on public packages. Aikido is a platform: code scanning, secrets, cloud posture, known bugs, all in one dashboard. Vigilance does one job: it reads the software that actually lands on your machine and reports the file that gained a capability it never had. Many teams run both.
Known Risk versus New Risk
A bug or a bad package someone already reported, with a name and a number. Most tools work here.
A file that gained a capability it never had, that no report covers yet. Vigilance works here.
Common Questions
Is Vigilance an Aikido Alternative?
Yes, for one job. Vigilance shows the file that gained a new capability, on your own machine. Many teams run it next to Aikido.
What Does Vigilance Do That Aikido Does Not?
Vigilance can look inside a package, installer or container, including one that never came from a public registry.
What Does Aikido Do That Vigilance Does Not?
Aikido scans code, cloud setups and known bugs across many scanners in one platform. Vigilance does not.
Does Vigilance Need the Internet or a Cloud Account?
The Free plan runs online. Pro runs fully offline, with no cloud account.
Try It on Your Own Software.
Show it the version you run today and the one you are about to install.
Talk to Us
A question, a pilot, or a bigger fleet? Send a note. It reaches a person.