Vigilance vs Aikido

Last checked 5 Oct 2026

Aikido runs many scanners in one cloud platform and scores your code, packages and cloud setup against known bugs. Vigilance watches what your staff's AI tools install and catches an update that gained a harmful power, such as reaching the internet or running a program.

Start the free 14-day trial See pricing

Where Aikido Stops

Aikido

  • Aikido's Safe Chain tool lists npm and PyPI.
  • It checks each download against Aikido Intel before the package installs, and holds back new releases for 48 hours by default.
  • The scanners on Aikido's product page do not list a vendor installer, a zip or a build your own team produced.
  • The pages we read state no comparison of a new version with the last safe one.
  • Aikido gives a verdict on a package.
  • A verdict depends on the feed having seen the package.

Vigilance

  • A power is something a file can do, such as reach the internet or run a program.
  • Vigilance compares each new version with the last safe one, so it needs no verdict first.
  • Vigilance reports the update that gained one.
  • On a paid plan, it swaps back to the last safe version.

Real case: axios, March 2026

  1. Release 1.14.1

    axios is one of the most-installed packages on the internet. This release added a hidden install step to its package.json file.

  2. The step

    It downloads software that lets an attacker control the computer. Anyone who installed that release, by hand or through an AI tool, got it. A feed can only judge a package it has seen. The change itself shows in a comparison of the two versions.

  3. What Vigilance reports

    HEADS UP. 1 file changed. package.json now runs a program during install and connects to the internet. On a paid plan, it also swaps the computer back to the last safe version.

Read the full record: axios npm attack, 2026. See more in the attack library.

For the wider field, read the software supply chain security tools guide or the full list of comparisons.

What Aikido Does Well

One platform

Aikido puts many scanners in one platform. Its site lists code scanning (SAST), package scanning (SCA), secrets detection, malware detection in packages and SBOM generation. It also lists cloud posture, infrastructure-as-code scanning, container and virtual machine scanning, DAST and API scanning. A small team gets one dashboard and one bill.

Fixes, not tickets

Aikido aims at the fix as well as the finding. Its homepage describes security that "opens a PR instead of a ticket".

Safe Chain

For npm and PyPI packages, Aikido has a free tool called Safe Chain. It wraps 16 package managers, including npm, yarn, pnpm, bun, pip, uv and poetry. It runs a local proxy and checks each download against Aikido Intel before the package installs. Aikido says Intel analyses a new package in about six minutes on average. These are the vendor's own figures, from the Safe Chain page and the Safe Chain announcement.

Free plan limits

The free Developer plan has limits: 10 repositories, 2 container images, 1 domain and 1 cloud account, with rescans every 3 days.

Feature Comparison

Aikido covers more scanning areas. Vigilance does one job, on the installs that land on staff computers.

Question Aikido Vigilance
Checks a public npm or PyPI package Yes Yes, when an AI tool or a person installs it
Checks a package before it installs Yes, with Safe Chain Checks each new version on our service. Paid plans swap a bad one for the last safe version
Waits before it accepts a new release Yes, 48 hours by default in Safe Chain No
Scans your code, secrets and cloud setup Yes No
Covers a vendor installer, a zip or your own build output Not among its listed scanners No. It covers npm, pnpm, yarn, bun, pip and uv installs
Compares the new version with the last safe one Not stated on its public pages Yes
Watches installs that AI tools make on a staff computer Yes. Aikido Endpoint lists Cursor, Claude Code, Copilot and Windsurf Yes. It watches installs from Claude Code, Cursor, Codex, GitHub Copilot, Devin Desktop and Gemini CLI, and installs a person types
Free plan Yes, with limits Yes, free for one person

The Aikido column comes from Aikido pricing, its product pages and the Safe Chain pages. "Not stated on its public pages" means the pages we read are silent.

When Aikido Is the Better Fit

Choose Aikido if

  • You want code scanning, secrets detection and cloud checks in one tool. It fits a team with no security staff that wants one place to look.
  • Your main risk is a bad package from npm or PyPI and you want it stopped before it installs. Safe Chain does this on a computer and in CI, and it is free.
  • You want fixes proposed as pull requests. Vigilance opens no pull requests.

Choose Vigilance if

  • Your staff vibe code and you want each update compared with its last safe version, with a swap back when it gains a harmful power.

Using Aikido and Vigilance Together

Safe Chain and Vigilance work at two moments.

Safe Chain, when a package asks to install

  • Safe Chain acts when a package asks to install.
  • It blocks a package its feed marks as bad and holds a new release for 48 hours.

Vigilance, on each new version

  • Vigilance checks each new package version on our service and reports any that gained a power.
  • A release that passes the feed and the wait can still carry a change nobody has reported.
  • Paid plans swap that update for the last safe version.

Pricing

Aikido

  • Aikido has a free Developer plan at $0 a month.
  • The pricing page asks for no credit card.
  • Paid plans named Basic, Pro and Advanced have public monthly prices, and Enterprise is custom.
  • Plans differ by the number of repositories, container images, domains and cloud accounts.
  • Safe Chain is free and needs no token.

Vigilance, per computer

  • SoloOne person on one computer. It checks the code your AI tools download and warns you in plain words if it turns harmfulFree plan
  • TeamIf an update turns harmful, it puts back the last good version on its own$49 per month
    $490 per year
  • Managed$2,500 one-time setup per company, or no setup fee on the yearly price. It also checks every app on the computer, and a security person checks each warning before you see it$199 per month
    $1,990 per year

Prices are per computer, per month, in US dollars, or in Canadian dollars when the card is from Canada. See the pricing section for the current numbers. The free 14-day trial puts a card on file and charges nothing until you say yes. It makes no swaps. Plan fees have a 60-day refund.

Which One Do You Need?

They overlap on public packages. You can run both.

Aikido

Aikido is a platform with many scanners.

Vigilance

Vigilance watches the packages your staff's AI tools install and reports the update that gained a power it never had.

Known Risk versus New Risk

Known risk

A bug or a bad package someone already reported, with a name and a number. Tools with a list of known problems work here.

New risk

An update that gained a power its last version never had, before any report covers it. Vigilance works here.

Common Questions

Is Vigilance an Aikido alternative?

Only for the part that guards package installs. Vigilance does not replace Aikido's code, secrets or cloud scanners. You can run it next to Aikido.

What does Vigilance do that Aikido does not?

Vigilance compares each new package version with the last safe one and names the power the update gained. On paid plans, it swaps to the last safe version. Aikido checks each package against its malware list. The Aikido pages we read state no version comparison and no swap.

What does Aikido do that Vigilance does not?

Aikido scans code, secrets, cloud setups and known bugs across many scanners in one platform. Its Safe Chain tool also blocks a bad npm or PyPI package before it installs. It waits 48 hours before it lets a new release in.

Does Aikido have a free plan?

Yes. Aikido lists a Developer plan at $0 a month, with limits on repositories, container images, domains and cloud accounts. Safe Chain is also free.

Does Vigilance need the internet or a cloud account?

Internet: yes. Each computer needs a network connection, because Vigilance checks each new package version on our service. It sends only public package names and versions. Your code and files stay on your computers. Cloud account: you need none of your own. You start with the free 14-day trial or a Vigilance plan.

Try It on Your Own Software.

Install Vigilance on each computer. After 14 days, we show you which packages your staff's AI tools installed, and any update that gained a harmful power.

Start the free 14-day trial Talk to us

Talk to us

A question, a pilot, or a bigger team? Send a note. It reaches a person.