Open source · self-hosted · one binary, no dependencies
Open-source AI security operations
Vaigil collects what happens on the platforms your organisation runs, detects what is wrong, lets an AI analyst take the first pass without letting it decide anything, and keeps a tamper-evident record of every action a person took about it. SIEM, SOAR and vulnerability management, in one self-hosted binary.
Built so that nobody, and no model, acts alone
AI that cannot be talked into anything
The AI analyst's plan is fixed in code before it reads a log line, its answer is one word from a closed set, and the reason a person reads is built from counts, so text an attacker wrote never reaches the screen of whoever decides.
Two people for what matters
An action on another platform is approved by somebody other than whoever asked, and making an administrator, issuing an administrator's token or weakening a setting takes a second administrator.
A record nobody can quietly change
Every change is in an append-only audit log: a hash chain, tree heads signed with Ed25519 and ML-DSA, and the head committed to Bitcoin.
Get started
Operations
Investigation
Detection
Exposure
People, sign-in and its own record
People
Who may do what, granted on a path, ending when it should.
Roles
Four roles in a ladder, three jobs beside it, and the duties kept apart.
Single sign-on
OpenID Connect and SAML, counted as two factors only when the provider says so.
Passkeys
Sign in with a passkey that checks it is you, and recover without a password.
Settings
Every setting, what it does, and why a weaker value needs a second administrator.
The audit log
An append-only, signed, anchored record, and a stream of it to another SIEM.
How Vaigil defends itself
Its own network purposes, sealed credentials, separate log writer and session limits.