TigerGate’s Cloud Security product runs posture scans against your cloud accounts on a schedule, surfaces failures into a unified inbox, and walks the IAM graph to show which principals can reach which resources.

​
What you get

CapabilityStatus
End-to-end posture scans across AWS / Azure / GCP / OCI / KubernetesLive — subprocess scanner, OCSF findings, dedup on re-scan
IAM graph (principals, policies, attachments, trust edges, resource grants)Live — collected on every scan, queryable per asset
Schedule-based scansLive — per-account cadence (6 h min, 24 h default) or cron expression
Manual “Run now”Live — UI button on each schedule row
Unified findings inboxLive — severity / status / framework filters, group-by, mute/resolve workflow
Compliance framework tags on findingsLive — refs stored on every finding
Compliance scoring per frameworkLive — severity-weighted score per framework, per account, rolled up
Attack-path traversalLive — lateral chains starting from each high-impact finding
MITRE ATT&CK matrix · Threat mapLive — tactic / technique heatmap and world-map projection

​
Provider coverage

ProviderConnect authCoverage
AWSRole ARN + external ID (STS assume-role), or access key + secret (+ optional session token); default regionPosture scans + IAM exposure graph
AzureService principal — subscription ID, tenant ID, client ID, client secretPosture scans + IAM exposure graph
GCPService-account JSON + project ID (optional region scope)Posture scans + IAM exposure graph
OCITenancy OCID, user OCID, fingerprint, private key (PEM), regionPosture scans
KubernetesOnboarded through KSPM’s in-cluster agent, not this pagePosture scans (see KSPM surfaces below)
M365 · GitHub · Cloudflare · OpenStack · Vercel · MongoDB Atlas · NHNPer-provider API credentialsPosture scans
Alibaba · Google Workspace · DigitalOcean · LinodePer-provider credentialsConnect + inventory only — no posture checks yet
Only AWS, Azure, and GCP build an IAM exposure graph. The catalog covers 1,227 checks across the 12 providers that have posture checks (AWS, Azure, GCP, M365, Kubernetes, OCI, OpenStack, Cloudflare, Vercel, GitHub, MongoDB Atlas, NHN) — see the check catalog.

​
Connecting a cloud account

Dashboard → Integrations → Cloud Providers → Add Provider. Pick the provider, fill in the auth fields, and save. Credentials are encrypted at rest (AES-256-CBC) and the connection is mirrored into the account list the scheduler reads from. Use Test on the saved connection to validate the credentials. What each provider needs:
ProviderForm fields
AWSRole ARN + external ID (preferred), or access key ID + secret access key (+ optional session token). Default region required.
AzureSubscription ID, Tenant ID, Client ID, Client Secret (all required).
GCPProject ID + service-account JSON (both required). Optional: regions to scope the scan.
OCITenancy OCID, User OCID, Fingerprint, Private key (PEM), Region.
Test connection does a live identity-API round-trip for AWS, GCP, and Azure (STS / Cloud Resource Manager / ARM) and for GitHub, Cloudflare, DigitalOcean, and Linode; the remaining providers get a required-field check until a live validator is wired up. Kubernetes clusters are onboarded through KSPM, not this page.

​
Triggers

TriggerWhen
ScheduleDefault cadence per account — configurable from 6 h (minimum) to 7 d. Default: 24 h. Cron expressions also supported.
ManualDashboard → Cloud Security → Schedules → Run now. Sets next_run_at = NOW(); the scheduler picks it up on the next tick.
There is no public REST or CLI surface for triggering a one-off scan yet — all dispatch flows through the schedule + Run-now path.

​
Dashboard surfaces

PageWhat it shows
OverviewRisk dial, by-severity donut, top failing checks, account fleet status
FindingsUnified inbox; group by check / provider / account / region / severity / resource type / service
AssetsEvery cloud resource discovered, with finding rollup. Group by provider / risk level / resource type / service
Asset detailPer-asset findings, IAM exposure neighborhood, software inventory
SchedulesPer-account cadence, last run, next run, manual Run now button
ScansScan history + filters
Scan detailPer-scan metadata + timeline
CompliancePer-framework severity-weighted score, control drill-down, per-control evidence
Attack PathsLateral chains starting from each high-impact finding
MITRE MatrixDetection density by ATT&CK tactic + technique
Threat MapFindings projected onto cloud regions on a world map
KSPM Overview / Cluster detailKubernetes posture rollup + per-cluster findings

​
IAM exposure

For any cloud asset (AWS / Azure / GCP), the Asset detail → IAM exposure panel walks the IAM graph in real time:
  • Principals with access to this resource (direct attachments + group / role chains)
  • Policies granting that access, with the effective action set
  • Trust edges that let one role assume another
  • Resource grants flipped the other way — “what can this principal reach?”
The graph is populated by the IAM collector that runs alongside every scan.

​
Scoring model

The compliance score is severity-weighted because stored findings are all failures — passing checks aren’t ingested into the inbox: 
score = 100 · (1 − weighted_open / max_penalty)

weighted_open = critical*4 + high*3 + medium*2 + low*1
max_penalty   = total_findings * 4   # worst-case: every finding critical
A clean framework → 100. All-critical-and-open → 0. Resolving a critical lifts the score 4× more than resolving a low.