TigerGate covers code, containers, cloud (CSPM), and AI pentest — all follow the same pattern: connect credentials, run a scan, triage findings in the unified inbox. Kubernetes (KSPM) and the runtime agent are in-cluster installs with their own guides.
1

Sign in & create an organization

Go to app.tigergate.dev and sign up. The first user becomes the Owner of a fresh org. If your team already has an org, ask the owner for an invite — see Organizations & teams.Signing up here puts your organization in us1, the default region. TigerGate also runs independent regions in Europe and India; each has its own dashboard, and an organization lives in exactly one of them for the rest of its life.If your data has to stay in a particular geography, sign up on that region’s dashboard instead of this one — see Regions. Everything else in this guide is identical whichever you pick.
2

Pick the surface you want to scan first

You don’t need to set everything up at once. Pick the one closest to whatever caused you to try TigerGate, finish that path, then come back for the rest.

Code

SAST · SCA · Secrets · IaC across GitHub / GitLab / Bitbucket / Azure DevOps.

Containers

CVE + malware + secrets in images from ECR / GCR / ACR / Docker Hub / GHCR.

Cloud (CSPM)

Posture scans for AWS / GCP / Azure / OCI with attack-path graphing.

AI Pentest

LLM-driven black-box pentest. Hosted or self-hosted worker for VPN-only targets.
Running Kubernetes? KSPM (cluster posture + admission) and the eBPF runtime agent install in-cluster with Helm — separate paths. See KSPM and Runtime agent.
3

Connect credentials

Every surface needs read-only credentials for the thing you’re scanning. From the left nav: Integrations → → Connect.
SurfaceWhat you connect
CodeGitHub App / PAT, GitLab token, Bitbucket app password, Azure DevOps PAT
ContainersRegistry credentials (ECR / GCR / ACR / Docker Hub / GHCR)
Cloud (CSPM)Read-only role (AWS) / service account (GCP) / app registration (Azure) / API key (OCI)
AI PentestTarget URL + optional auth header / session cookie
Click Test connection before saving — TigerGate verifies access immediately so misconfigured creds fail fast.
4

Run your first scan

After the integration goes green, the dashboard lists everything the credential can see (repos, images, accounts, targets). Click Scan now on one. Default scan config is sensible for a first run — leave it on.Scans land in → Scans. Most first scans complete in 1–5 minutes. Status flows: queued → running → completed. The completed row links straight to Findings.
5

Triage your first findings

→ Findings is the unified inbox.
  • Each row is one finding (rule + resource + location) with severity, status, and check ID.
  • Click a row to open the side panel: rule explanation, evidence, suggested fix, framework tags (PCI / SOC2 / OWASP / CIS).
  • Use Group by in the toolbar to switch between flat list and grouping by finding / provider / service / severity / resource type.
Mark a finding as MUTED (false positive), RESOLVED (fixed), or leave it NEW for triage.
6

Automate (optional but recommended)

Once findings stop being noise, wire scanning into your workflow:
  • Code — gate PRs with the CI/CD quality gate. Build fails on new findings above the severity floor.
  • Containers — scan on every image push from CI; block deploys via the same gate.
  • Cloud (CSPM) — scheduled posture scans run automatically once the role is connected.
  • AI Pentest — schedule a recurring run against staging.
API keys for automation live under Organization → API Keys → New.