What is TigerGate?
TigerGate is a fully centralised, SaaS-delivered code-to-cloud security platform. Every scanner, every worker, every database runs in TigerGate’s infrastructure. You connect credentials and use the dashboard — there is nothing to deploy for the core platform. Most security tooling is a stack of point products: a SAST scanner here, a cloud-posture scanner there, a runtime agent, a registry scanner, each with its own install, dashboard, user model, and reporting. TigerGate replaces that stack with one centralised platform that owns the full commit-to-runtime loop, with consistent findings, a single inbox, one RBAC model, and one set of compliance reports.Code Security
SAST · SCA · Secrets · IaC. Plug in GitHub / GitLab / Bitbucket / Azure DevOps, scan on every PR, gate merges in CI.
Container Security
CVE + malware + secrets in container images, with SBOM export. Runs against ECR / GCR / ACR / Docker Hub / GHCR.
Cloud Security (CSPM)
1,227 posture checks across AWS / Azure / GCP / OCI / Kubernetes / M365 / GitHub / Cloudflare and more, with IAM exposure graphing and 38+ compliance frameworks.
AI Pentest
LLM-driven black-box pentest (TigerStrike). Hosted by default; self-hosted worker available for targets behind a VPN.
Fully centralised by design
Every part of the platform runs in TigerGate’s cloud. You don’t deploy scanners, you don’t manage worker pools, you don’t run a control-plane database, you don’t host a dashboard.| Component | Where it runs |
|---|---|
| Code · container · cloud · pentest · API · AI scanners | TigerGate SaaS |
| Findings inbox · dashboards · attack-path graph · compliance scorecards | TigerGate SaaS |
| User management · RBAC · SSO · audit log | TigerGate SaaS |
| Encrypted credential vault (AES-256-CBC at rest) | TigerGate SaaS |
| Per-framework reports (SOC 2 / PCI / HIPAA / ISO / GDPR / FedRAMP / CIS, …) | TigerGate SaaS |
| eBPF runtime agent (optional) | Your Linux hosts — the only piece that has to live next to the workload, because it collects kernel-level evidence |
| Self-hosted pentest worker (optional) | Your infra — only required when the pentest target is behind a VPN and unreachable from the public internet |
Why centralised
| Nothing to deploy | No Helm charts to manage, no scanner version drift, no worker autoscaling problems. The platform always runs the latest checks. |
| Always up-to-date | New CIS / CVE / OWASP rules are live the moment we ship them — your scans pick them up on the next run with no upgrade step. |
| Centralised RBAC, SSO, audit log | One place to grant access, one place to revoke, one place auditors look. SAML / OIDC / SCIM included. |
| Centralised credential vault | Read-only cloud roles, registry tokens, code-provider PATs, LLM-provider keys — all stored encrypted in one place. |
| One inbox, one report | Findings from every surface land in the same dashboard with the same severity / status / framework filters. One compliance PDF covers everything. |
| Predictable cost | Per-seat or per-asset pricing; no infra to size, no cloud bill to absorb for the platform itself. |
Pick a path
I want to ship a first scan
5-minute walkthrough — connect a credential, run a scan, view findings.
I want to gate CI on findings
Per-CI snippets + quality gate to fail builds on new findings.
I want every cloud check
Browse the full 1,227-check posture catalog by provider and service.
I'm an SRE wiring runtime monitoring
eBPF runtime agent — DaemonSet on Kubernetes / systemd unit on bare metal. The only thing you install.
What you’ll need
- A TigerGate dashboard account with permission to create API keys (sign in at app.tigergate.dev).
- Whatever credentials match the surface you’re scanning — a GitHub PAT for code, an AWS read-only role for cloud posture, a registry token for images, a target URL for pentest. All credentials are encrypted at rest in the SaaS vault.
- No infrastructure to provision. The two optional in-customer pieces (runtime agent, self-hosted pentest worker) each have their own setup pages and aren’t required for the core product.