Vigolium combines classic scanning with agentic audits

What this is about

Vigolium is a concrete AI security tool for web applications and codebases. It combines classic deterministic vulnerability scanning with an agentic audit mode that explores targets, selects modules, generates extensions, and re-checks findings.

The tool fits a gap many security teams feel in 2026: pure scanners produce noise, while pure LLM code reviews can hallucinate too easily. Vigolium tries to combine both and make findings useful through evidence.

What Vigolium actually does

Vigolium provides two paths. The native command vigolium scan runs a multi-phase assessment: content discovery, browser and SPA spidering, active and passive auditing, out-of-band testing, and reports. The GitHub repository lists 317 scanner modules and inputs such as URLs, OpenAPI files, Postman collections, Burp Suite data, and cURL.

The second path is vigolium agent. Here an agent plans the assessment, uses source-code audits, selects modules, generates JavaScript extensions, and triages results. Supported provider drivers include OpenAI-compatible endpoints, OpenAI, Anthropic, Vertex, and OAuth variants.

The architecture boundary matters too. According to Help Net Security, anything that finds bugs stays in the AGPL repository, while the commercial Cloud Console adds operations, hosting, collaboration, scaling, and scheduling on top.

Why it matters

Security work needs reproducible evidence. An agent that only describes a plausible vulnerability is not very useful if a developer cannot reproduce it. Vigolium addresses this through separate scan and triage phases. Author Jessie Ho told Help Net Security that triage checks candidates again against their evidence.

For real users, the budget model is almost as important as the AI itself. Vigolium supports caps for tokens, tool calls, triage iterations, and wall-clock time. That is practical because agentic security runs can otherwise stop too early or burn cost without adding value.

The tool is therefore especially relevant for AppSec teams, bug bounty programs, small security teams, and developers who want deeper targeted checks next to CI scanning. It does not replace a penetration test, but it can reduce the gap between automated scanning and manual analysis.

In plain language

Vigolium is like a building inspector with a checklist and a flashlight. The checklist checks doors, windows, and locks the same way every time. The flashlight helps inspect unusual corners, but every finding still needs a photo and an exact location before anyone acts on it.

A practical example

A SaaS team runs an API with 80 endpoints and a React frontend. Before each release, a fast native Vigolium scan runs against staging. It checks known classes such as XSS, SQL injection, SSRF, authentication bugs, and access control flaws.

Once a week, the team also starts vigolium agent autopilot with source code and the staging target. The agent gets 45 minutes of wall time, a fixed token budget, and the focus "BOLA and role switching". If it finds five candidates, triage checks them separately. Two findings are marked reproducible, two are downgraded, and one remains as low-confidence evidence in the report. It does not remove responsibility, but it reduces sorting work.

Scope and limits

First, Vigolium extensions execute JavaScript and can run arbitrary commands without a sandbox according to Help Net Security. Third-party extensions should not be added to production environments without review.

Second, agentic scanning needs strict budgets. Too little budget cuts off real leads; too much creates cost and noise.

Third, the tool must only run on owned or explicitly authorized targets. A powerful scanner remains legally and operationally risky when scope is unclear.

SEO & GEO keywords

Vigolium, AI security scanner, AppSec, vulnerability scanner, agentic scan, web security, OWASP Top 10, LLM security, bug bounty, AGPL, security automation, source-code audit