TigerStrike is TigerGate’s AI Pentest product. It drives 2–4 parallel agents (each with its own browser + terminal + HTTP proxy sandbox) against a target, finds vulnerabilities, and writes them up with reproducible payloads.
Target typeExamples
Web appA SaaS dashboard, a marketing site with a login form
APIREST / GraphQL / SOAP endpoints with optional auth
CodebaseRepo on disk or a public Git URL — code-aware analysis

​
Hosted vs. self-hosted

You have two ways to run TigerStrike:
  • Hosted (SaaS) — Public targets only. Zero install. Pick a target in the dashboard, click Start. Pay per scan minute. See Hosted scan.
  • Self-hosted worker — Run a worker on a VM in your network. Required when targets are behind a VPN / on a private subnet / under an IP allow-list. See Self-hosted worker.
The two paths share everything above the worker — same dashboard, same target/scan-config UI, same findings inbox, same budgets. The only difference is where the agent’s sandbox runs. Both the hosted worker and your self-hosted worker connect outbound only to the TigerGate platform — your region’s API host, api.tigergate.dev on us1 — for jobs, findings, and spend. The hosted worker reaches public targets over HTTPS; your worker reaches private targets over HTTPS/VPN.

​
How a scan runs

1

You define a target + scan config in the dashboard

Pentest → Targets → New. Pick web/api/codebase, set scope (auth, api, auth+api, full), set max duration + per-scan budget.
2

The platform queues a job and a worker claims it

Hosted: TigerGate’s worker. Self-hosted: yours.
3

The worker spawns 2–4 sandbox containers

Each sandbox has a headless browser, a terminal, and an HTTP proxy. The agents share information through the platform but otherwise run independently.
4

Agents probe the target, find vulnerabilities, write them up

Findings stream in live — you see them as they’re confirmed, not at the end. Each finding has a reproducible payload and an exploit narrative.
5

Scan ends on time-cap or budget-cap

Whichever comes first. Findings + spend telemetry persist in the dashboard.

​
Costs

LLM calls are billed against the AI provider key you configure in the dashboard (OpenAI / Anthropic / Gemini / Azure OpenAI / OpenAI-compatible self-hosted). You set:
  • Per-scan budget (USD) — hard ceiling for one scan
  • Monthly org budget (USD) — hard ceiling across all scans this month
When a budget cap is reached, in-flight LLM calls finish and the scan is marked budget_exhausted. See Budgets & spend.
In the self-hosted flow the LLM key still lives on TigerGate’s side — never on your worker. The platform injects it into each scan job at runtime. Your worker host doesn’t need outbound access to OpenAI / Anthropic / etc.

​
Findings

Same inbox primitives as code/cloud/container — severity, status, framework tags. TigerStrike findings additionally include:
  • Reproducible payload — the exact request/body that triggered the vulnerability
  • Step-by-step exploit narrative — what the agent tried, what worked
  • Evidence — screenshots, response bodies, exfiltrated data (redacted PII)
  • Remediation — concrete code/config fix, owasp/cwe references
See Findings.