How we sit next to the tools you already run.

Most of these find problems somebody already reported. Vigilance finds what is new. You almost always want both, and every page below says so.

Everything on one chart

Tool	Finds known bugs	Spots a new risky file	Spots changed behaviour	Looks inside containers	Watches live machines	Works with no internet
Vigilance	No	Yes	Yes	Yes	Yes	Yes
Black Duck	Yes	No	No	Yes	No	No
Snyk	Yes	No	No	Yes	No	No
Socket	Yes	Yes	Yes	No	No	No
Sonatype Nexus	Yes	Some	No	Yes	No	No
JFrog Xray	Yes	No	No	Yes	No	No
Chainguard	Yes	No	No	Some	No	No
Tripwire	No	Some	No	No	Yes	Yes
Wiz	Yes	No	No	Yes	Some	No
GitHub Advanced Security	Yes	No	No	No	No	No
Sigstore and SLSA	No	No	No	No	No	No
Trivy	Yes	No	No	Yes	No	Some
Semgrep	Some	Some	No	No	No	Some

Lists the open source parts inside your software and flags the ones with known bugs.

Checks your code and the parts you depend on against a list of known bugs, then opens pull requests to fix them.

Reads packages from public places like npm and flags a new version that starts running scripts or reaching the internet.

Holds your packages and blocks the ones it knows are bad before a build can pull them.

Scans everything stored in Artifactory and reports known bugs, licence problems and where a bad part came from.

Builds container images that hold almost nothing, so there is almost nothing in them to go wrong.

Watches files on a server and tells you when one changed. You write a policy first that says which files matter.

Looks across your cloud accounts and shows where they are exposed, with nothing to install on each machine.

Warns you when a part you depend on has a known bug, when a password gets committed, and when its scanner finds a mistake in your code.

Signs a release and records how it was built, so you can prove it came from the build you expect.

Scans containers, folders and repositories for known bugs, bad settings and committed passwords. It is free and runs anywhere.

Reads source code and finds mistakes in it, using rules you can write yourself.

Show it the version you run today and the one you are about to install.