Vulnerability Management

TigerGate provides continuous scanning across four layers: code and open-source dependencies (SAST and SCA), cloud infrastructure and IaC (CSPM, Terraform, Helm), container images (base layers, packages, malware, secrets), and running workloads monitored via the eBPF agent. All findings are aggregated into a single de-duplicated inventory so you never triage the same vulnerability twice.

CVSS scores describe the theoretical severity of a vulnerability in isolation. TigerGate enriches each finding with three additional signals: exploitability (does an active exploit exist in the wild?), reachability (is the vulnerable code path actually executed in your environment?), and business impact (how critical is the affected asset and is it publicly exposed?). This lets you focus remediation on the roughly 5% of findings that are genuinely dangerous rather than chasing every high-CVSS CVE. The result is a 75% reduction in mean time to remediation.

Code and cloud scanning is agentless: you supply repository tokens (GitHub, GitLab, Bitbucket) and cloud credentials (AWS, Azure, GCP, Oracle Cloud) through the dashboard, and TigerGate calls provider APIs to clone repos and enumerate cloud resources. For runtime vulnerability detection on running workloads you can optionally deploy the lightweight eBPF agent, which adds less than 3% CPU overhead and requires no kernel modules.

Virtual patching deploys eBPF enforcement rules to block exploitation attempts targeting a known vulnerability while a permanent code or package fix is being prepared. This is useful for critical CVEs where an official patch does not yet exist, where patching requires a lengthy release cycle, or where the vulnerable library cannot be upgraded immediately due to compatibility constraints. Virtual patching is available as a one-click action from the vulnerability detail page.

TigerGate pulls from the National Vulnerability Database (NVD), GitHub Advisory Database, OSV (Open Source Vulnerabilities), and Snyk Vulnerability DB. Exploit-in-the-wild signals come from MITRE ATT&CK and proprietary threat intelligence. All sources are cross-referenced and de-duplicated so each unique vulnerability appears once, regardless of how many databases report it.

Yes. Every finding is mapped to the relevant control requirements for SOC 2, ISO 27001, PCI-DSS, and HIPAA. TigerGate generates vulnerability lifecycle reports showing discovery date, priority score, remediation actions taken, and closure date, which provides the evidence auditors need to verify your vulnerability management program. Compliance dashboards show current posture against each framework in real time.