What is TigerGate?
TigerGate is a centralised, SaaS-delivered code-to-cloud security platform. The scanners, workers and databases run in TigerGate’s infrastructure, and for most products you connect credentials and use the dashboard — there is nothing to deploy. The exceptions are the Kubernetes and runtime agents, the optional self-hosted pentest worker, and the Data Security scanner, which reads cloud and on-prem data inside your own environment. Most security tooling is a stack of point products: a SAST scanner here, a cloud-posture scanner there, a runtime agent, a registry scanner, each with its own install, dashboard, user model, and reporting. TigerGate replaces that stack with one centralised platform that owns the full commit-to-runtime loop, with consistent findings, a single inbox, one RBAC model, and one set of compliance reports.- Code Security — SAST · SCA · Secrets · IaC across GitHub / GitLab / Bitbucket / Azure DevOps. Scan on every push, gate merges in CI.
- Container Security — CVEs, malware, and secrets in container images, with SBOM export. Runs against ECR / GCR / ACR / Docker Hub / GHCR.
- Cloud Security (CSPM) — 1,227 posture checks across AWS / Azure / GCP / OCI / M365 / GitHub / Cloudflare and more, with IAM exposure graphing and 38+ compliance frameworks.
- Data Security (DSPM) — find sensitive data across AWS / Azure / GCP, on-prem databases and file shares, and SaaS tools, and who can reach it. Cloud and on-prem data is read by a scanner in your own environment.
- Kubernetes Security (KSPM) — CIS/NSA benchmarks, RBAC (KIEM) exposure, admission control, image CVEs, and drift, from one read-only in-cluster agent installed with Helm.
- AI Pentest (TigerStrike) — LLM-driven black-box pentest. Hosted by default; self-hosted worker for targets behind a VPN.
- Runtime Agent — TigerGate eBPF sensor streaming process / file / network / privilege events from Kubernetes, a Linux host, or Docker.
Fully centralised by design
The platform runs in TigerGate’s cloud. You don’t manage worker pools, you don’t run a control-plane database, you don’t host a dashboard. The few pieces that run on your side are listed in the table below.| Component | Where it runs |
|---|---|
| Code · container · cloud · pentest · API · AI scanners | TigerGate SaaS |
| Findings inbox · dashboards · attack-path graph · compliance scorecards | TigerGate SaaS |
| User management · RBAC · SSO · audit log | TigerGate SaaS |
| Encrypted credential vault (AES-256-CBC at rest) | TigerGate SaaS |
| Per-framework reports (SOC 2 / PCI / HIPAA / ISO / GDPR / FedRAMP / CIS, …) | TigerGate SaaS |
| KSPM + runtime agent (optional) | Your Kubernetes cluster / Linux hosts — one read-only agent, installed with Helm, for cluster posture, admission control, and eBPF runtime evidence |
| Self-hosted pentest worker (optional) | Your infra — only when the pentest target is behind a VPN and unreachable from the public internet |
| DSPM scanner (Data Security only) | Your AWS / Azure / GCP account or a Linux host, deployed with Terraform — reads your data in place and sends TigerGate only findings and metadata |
Why centralised
| Nothing to deploy | No Helm charts to manage, no scanner version drift, no worker autoscaling problems. The platform always runs the latest checks. |
| Always up-to-date | New CIS / CVE / OWASP rules are live the moment we ship them — your scans pick them up on the next run with no upgrade step. |
| Centralised RBAC, SSO, audit log | One place to grant access, one place to revoke, one place auditors look. SAML 2.0 single sign-on included. |
| Centralised credential vault | Read-only cloud roles, registry tokens, code-provider PATs, LLM-provider keys — all stored encrypted in one place. |
| One inbox, one report | Findings from every surface land in the same dashboard with the same severity / status / framework filters. One compliance PDF covers everything. |
| Predictable cost | Per-seat or per-asset pricing; no infra to size, no cloud bill to absorb for the platform itself. |
What you’ll need
- A TigerGate dashboard account with permission to create API keys. Sign in on the dashboard of the region your organization is in — app.tigergate.dev for
us1, the default. - Whatever credentials match the surface you’re scanning — a GitHub PAT for code, an AWS read-only role for cloud posture, a registry token for images, a target URL for pentest. All credentials are encrypted at rest in the SaaS vault.
- No infrastructure to provision. The optional in-customer pieces — the Helm-installed KSPM / runtime agent, and the self-hosted pentest worker — each have their own setup pages and aren’t required for the core product.