Vigil
Self-hosted continuous authorization for federal systems.
Vigil ties each security control to the evidence behind it, scores every control for coverage and freshness on a schedule, and produces signed evidence packages and OSCAL documents an assessor can check offline. It runs inside your boundary, connected or air-gapped, and records every change in a tamper-evident audit trail.
Vigil, a product of Wagoner Enterprises.
Your ATO, current every day and provable.
Most programs gather authorization evidence by hand once a cycle, scattered across tools, so gaps show up during assessment. Vigil keeps that evidence linked, measured, and verifiable without sending any of it outside your boundary.
Ready for the assessor any day.
Every control shows how well it is supported and how current that support is. Leadership sees posture across all boundaries on one live view, and the program can hand over a signed package whenever it is asked.
Evidence nobody can vouch for.
Stale evidence and open remediation surface during operations instead of at assessment. Outputs are signed, changes are recorded in a tamper-evident trail, and one person cannot find, fix, and sign off the same weakness.
Authorization is moving to continuous.
Continuous monitoring guidance expects current evidence rather than annual snapshots. OMB M-24-15 points federal authorization toward machine-readable OSCAL packages, and hand assembly gets more expensive each month.
Evidence linked, scored, and kept current.
The same workflow runs in government cloud or from file uploads inside a disconnected enclave.
Ingest
Evidence arrives as single or bulk uploads. Each item is fingerprinted on arrival and tagged with its type, source, boundary, and classification.
Link
Controls are tied to implementation statements and evidence, and each link records who made it and why.
Score
Each control gets a coverage score and a freshness score for its boundary. Evidence past its useful age stops counting.
Monitor
Scheduled runs re-score each boundary, keep snapshots for comparison, and send signed alerts when posture slips.
Remediate
Scan findings become POA&M items with due dates. Closure needs evidence and a verifier who had no hand in the item.
Prove
Vigil exports signed evidence packages and approved OSCAL SSP, SAR, and POA&M documents. Assessors verify them offline.
One boundary, one graph, one integrity layer.
Evidence enters through one authenticated perimeter, lives in the graph, is scored by the assurance engines, and leaves only as signed, marked output.
Posture you can see, packages you can prove.
What makes continuous defensible.
Outputs an assessor checks alone
Evidence packages and published OSCAL documents are signed with keys you hold. The assessor verifies them offline, and a single changed byte fails the check.
Freshness as a number
Every control carries coverage and freshness scores for its own boundary, kept as history. Staleness shows up as a trend during operations, long before an assessment finding.
Separation of duties, enforced
An OSCAL author cannot approve their own document, and a POA&M owner cannot verify their own closure. Risk acceptance needs a justification and an expiry date.
Every change on the record
Each change is written to the audit trail together with the change itself, so nothing commits without a record. The trail is tamper-evident and can be verified from the interface.
Tenant isolation in the database
The database itself keeps each tenant's data apart, below the application. That matters for multi-agency and managed-service deployments.
Zero egress, license included
Vigil runs inside your boundary with customer-held keys and file-based ingestion. The license is verified locally with no phone-home, and an expired license leaves your evidence readable.
Where it fits among the tools you already know.
Vigil sits beside the systems of record that hold the authorization and supplies them with current, verifiable evidence.
| Capability | Vigil | Federal GRC and package tools | Compliance-automation SaaS | OSCAL-native platforms |
|---|---|---|---|---|
| Signed, offline-verifiable packages | Yes | Rare | Rare | Rare |
| OSCAL SSP, SAR, POA&M | Validated, approved, signed | Varies, often an add-on | Varies | Core strength |
| Evidence freshness scoring | Per control and boundary | Usually manual review dates | Often, for cloud sources | Varies |
| Self-hosted and air-gapped | Yes, with offline licensing | Some on-premises options | Typically SaaS only | Some |
| Customer-held signing keys | Yes, cloud key service or HSM | Varies | Usually vendor-managed | Varies |
| Separation of duties | Enforced in the product | Often by process | Varies | Varies |
Start with one boundary and the evidence you have.
No integrations are needed to begin. Upload the artifacts you already collect and get measured, signed posture for one system.
Freshness for one boundary
See which controls are supported and which evidence is going stale.
Monthly monitoring packages
Scored snapshots and drift each cycle, delivered as a signed package.
POA&M discipline
Due dates, overdue tracking, and closure verified by someone else.
Who buys it: ISSOs, ISSMs, and system owners in DoD and civilian programs, cloud providers with FedRAMP deliverables, and defense contractors preparing for CMMC.
Built around the guidance your assessor applies.
Vigil supports the Authorizing Official's judgment and does not replace it. Alignment is in design and structure, not a certification.
This is a public-safe overview. Scoring details and internal design are available under appropriate agreements.
Change one byte and watch it fail.
We run a sanitized walkthrough on a sample of controls, hand you the signed package and OSCAL documents to verify offline, then tamper with the package so you can watch verification fail.