--profile infra), reports each server’s software and configuration, and TigerGate matches it against vulnerability advisories, vendor lifecycles and a hardening benchmark.
What it finds
| Area | What is reported | Platforms |
|---|---|---|
| OS vulnerabilities | Installed OS packages (dpkg, rpm, apk) matched against the distribution’s security advisories; the Windows build against Microsoft security updates; the macOS version against published CVEs | Linux, Windows, macOS |
| Application vulnerabilities | Libraries inside deployed applications (JAR, WAR and EAR files, node_modules, Python environments, .NET, PHP, Ruby and Go binaries) and runtimes installed outside the package manager, such as a Java, Tomcat or Node.js unpacked into /opt | Linux, Windows, macOS |
| Third-party applications | Widely used programs (browsers, Adobe Acrobat and Reader, Zoom, Oracle Java, OpenSSL, MySQL, Redis and common tools) matched against the National Vulnerability Database | Linux, Windows, macOS |
| Microsoft products | Microsoft 365 Apps and Office (Click-to-Run, per update channel), .NET Framework 4.x, the .NET, ASP.NET Core and Windows Desktop runtimes, SQL Server 2016 SP3 to 2025 (GDR and cumulative-update branches) and Exchange Server 2016, 2019 and Subscription Edition, matched against the fixed builds Microsoft publishes. One finding per install and update, with the KB and fixed build | Windows |
| Application servers and databases | Oracle WebLogic Server and Oracle Database, IBM WebSphere Application Server (traditional and Liberty) and Red Hat JBoss EAP, matched by patch level read from the install’s own patch records, so a fully patched server is not flagged with every CVE of its base release. A server whose patch level cannot be read is shown as patch level unknown and is not assessed. | Linux, Windows |
| End-of-life software | OS releases, runtimes and libraries past their maintainers’ end of support, which receive no more security fixes | Linux, Windows, macOS |
| Hardening (CIS and DISA STIG) | Configuration checks aligned to the CIS Benchmarks: 131 for Linux, 240 for Windows Server 2022 (Level 1 and 2), 223 for Windows 10 and 11, 46 for macOS. DISA STIG rules for Windows Server 2022, Windows 11, RHEL 8 and 9 and Ubuntu 22.04, with the coverage of each STIG listed on the Hardening page | Linux, Windows, macOS |
| Custom audits | Your own read-only checks, written in the console or imported from Tenable .audit files, evaluated on each server. See Custom audits | Linux, Windows, macOS |
| Missing Windows updates | The security updates (KB) each Windows server is missing, with the CVEs each one fixes | Windows |
/opt/billing/app.war!/WEB-INF/lib/log4j-core-2.14.1.jar. That location is what has to be upgraded.
How it works
- The agent runs on a schedule, reads package databases, application directories and configuration files, reports, and exits. It is not a resident service and does not need a kernel component.
- TigerGate matches the report against vulnerability advisories, a product lifecycle table and the hardening benchmark.
- Results appear under Infra Vulnerabilities in the console. Findings close automatically when a later scan no longer sees the problem.
Where to find results
| Tab | Shows |
|---|---|
| Overview | Severity totals, threat context (CISA KEV, EPSS, end of life) and coverage |
| Hosts | Every server, its risk, criticality, last report and agent version. Set criticality, request a scan and manage scan groups here. |
| Packages | Every installed package across the fleet, OS and application |
| Findings | One row per vulnerability per server, with the affected installs |
| Prioritize | One row per vulnerability across the fleet, ranked |
| Remediate | The upgrade plan, and the Windows updates missing across the fleet |
| Hardening | The CIS benchmarks for Linux, Windows Server and macOS: score, failing controls and the servers that fail them |
Prioritize and act
- Asset criticality. Mark each server low, medium, high or critical, one at a time or in bulk. Criticality raises or lowers each vulnerability’s priority score and multiplies the server’s risk score, and the reason is shown with the score. A vulnerability on CISA’s Known Exploited list never drops below 90.
- Scan now. Ask one or many servers to scan at their next check-in, within about 15 minutes. The request clears when the resulting report arrives, and is ignored after 24 hours if the agent never acts on it.
- Scan groups. Owners and admins can give groups of servers their own scan interval and a daily scan window in a chosen time zone, for example only between 01:00 and 05:00. Servers outside every group follow the organization’s interval.
- Missing Windows updates. Each Windows server lists the security updates it is missing, with the CVEs each fixes and the newer update that supersedes it. The Remediate tab ranks the updates missing on the most servers. | Reports | Exportable reports |
Get started
Install the agent on a server
Follow Install the agent on servers, or open Integrations → Overview → Server & Infrastructure in the console to generate the command.
Already running the agent?
Update it to the latest release to collect application vulnerabilities, end-of-life software and hardening results. See Update an existing agent.