Vigilance vs Trivy
Trivy. Scans containers, folders, and repositories for known bugs, bad settings, and passwords. Vigilance finds the update that gained a hidden power, before you install it.
The Catch Trivy Cannot Make
Trivy scans for known bugs and bad settings. A brand-new attack has no known bug to match. Vigilance keeps no list. It compares the version you trust with the version you install. It reports any file that can suddenly do more.
A real one: axios, March 2026
axios is one of the most-installed packages on the internet. In release 1.14.1, its package.json gained a hidden install step. That step pulls down a remote-control program. Trivy had nothing to flag, because no CVE existed. One command sees it:
vigi diff --old ./axios-1.14.0 --new ./axios-1.14.1
HEADS UP. 1 file changed. package.json can now run a hidden helper on install and reach the network.
Run both. Trivy catches what is already known. Vigilance catches the change no report lists yet. See them side by side below.
Side by Side
| Question | Trivy | Vigilance |
|---|---|---|
| Finds a known bug in a container | Yes | No |
| Finds a bad setting or a committed password | Yes | No |
| Compares this version against the last one | No | Yes |
| Spots a file that can suddenly run commands | No | Yes |
| Spots a file that now runs a different program than before | No | Yes |
| Keeps a local record of every check | No | Yes |
Which One Do You Need?
Use both. Trivy finds what is known to be bad today. Vigilance finds what is new since last time.
Known Risk versus New Risk
A bug or a bad package someone already reported, with a name and a number. Most tools work here.
A file that gained a capability it never had, that no report covers yet. Vigilance works here.
Common Questions
Is Vigilance a Trivy Alternative?
Yes, for one job. Vigilance shows the file that gained a new capability, on your own machine. Many teams run it next to Trivy.
What Does Vigilance Do That Trivy Does Not?
Vigilance can spot a file that can do more than the version before, and flag a brand-new bad file by what it can do.
What Does Trivy Do That Vigilance Does Not?
Trivy finds known bugs that already have a name and a number. Vigilance does not.
Does Vigilance Need the Internet or a Cloud Account?
The Free plan runs online. Pro runs fully offline, with no cloud account.
Try It on Your Own Software.
Show it the version you run today and the one you are about to install.
Talk to Us
A question, a pilot, or a bigger fleet? Send a note. It reaches a person.