About TigerStrike
We're on a mission to make continuous pen testing accessible, auditor-ready, and fast enough to match modern delivery — for every development team, in every framework they need to clear.
Our Mission
Modern software ships daily. Compliance frameworks (SOC 2 Type 2, PCI DSS 11.4, HIPAA 164.308(a)(8), ISO 27001 surveillance, CERT-In) now expect continuous security evidence — not an annual snapshot. The gap between how fast teams ship and how often they can afford pen testing has become the single biggest audit-friction cost in software businesses.
TigerStrike exists to close that gap. We build AI-driven pen testing agents that produce validated vulnerability evidence continuously, map every finding to the frameworks our customers' auditors care about, and ship reports that attestation CPA firms, QSAs, ISO certification bodies, HIPAA assessors, and CERT-In empanelled auditors accept on the first pass.
Our Story
TigerStrike was founded in 2025 by Joe and Fizer Khan, who had spent years watching application security fall behind modern development. The pattern repeated across every company they worked with: pen testing engagements took weeks to schedule, cost tens of thousands of dollars, and arrived with findings that were already stale by the time production shipped the next feature.
They started TigerStrike with a different operating model — AI agents that enumerate attack surface, reason about application context, chain exploits, and validate findings continuously. Human expertise concentrates on validation of edge cases, business-logic reasoning, and strategic prioritisation. The mechanical pentester-hours that dominate traditional engagement cost become machine work.
We are fully bootstrapped and proud of it. No outside investors, no term-sheet pressure, no compromises on long-term product bets to hit a short-term revenue plan. That independence lets us build the product our customers actually need: continuous evidence, auditor-ready reports, transparent subscription pricing, and roadmap decisions made with security teams rather than growth boards.
Today TigerStrike protects applications and infrastructure for hundreds of customers across SaaS, fintech, healthcare, legal tech, government, and regulated BFSI. We are proud of every SOC 2 Type II report we helped shorten, every PCI DSS 11.4 engagement we replaced with continuous coverage, every CERT-In audit we accelerated, and every ransomware incident we prevented by surfacing an exposed RDP endpoint before an attacker did.
How We Build
AI replaces mechanical work, not expertise
AI agents enumerate attack surface, chain exploits, and validate findings at machine scale. Human judgement concentrates on edge cases, business logic, and strategic prioritisation — the work that actually requires expertise.
Evidence beats effort
A pen testing programme is judged on the evidence it produces for auditors, procurement, and incident response — not on hours billed. Every TigerStrike feature exists to produce stronger evidence per unit of cost.
Validate every finding
Scanner-only findings create developer fatigue and audit scepticism. TigerStrike validates with a working proof-of-concept where safe to do so — so the finding list is a work queue, not a noise filter.
Compliance-ready by default
SOC 2, ISO 27001, HIPAA, PCI DSS, GDPR, RBI, and CERT-In mappings are built into every scan — not bolted on at report time. One engagement produces evidence for every applicable framework.
Milestones
Founded
Joe and Fizer Khan start TigerStrike after years of watching pen testing engagements fall behind modern delivery velocity.
First 143 scanners
The scanner catalogue reaches 143 across web, API, mobile, cloud, and network attack surface.
SOC 2 Type II
TigerStrike earns SOC 2 Type II certification — the first compliance framework a security vendor must clear credibly.
ISO 27001 + Auditor Portal
ISO 27001 certification lands alongside the auditor collaboration portal — making TigerStrike reports first-class evidence for Big 4 and Top-10 attestation firms.
CERT-In Alignment
CERT-In audit alignment and on-premise / air-gapped deployment ship for government, CII, and regulated BFSI customers in India.
AI / LLM pen testing
Prompt injection, RAG pipeline testing, vector-store authorisation, and tenant-isolation scanners ship as standard scope.
Our Founders
Joe
CEO
Leading TigerStrike's vision to make continuous AI pen testing the default for every development team.
Fizer Khan
CTO
Architecting the AI agent platform that powers TigerStrike's 143+ scanners and compliance-mapped evidence.
Our Values
Security First
Security is at the core of everything we build — including the platform itself.
Customer Focus
We succeed when our customers ship faster and clear vendor security reviews on the first pass.
Global Impact
Making the world more secure, one application and one audit cycle at a time.
Excellence
We hold our platform to the standards our customers' auditors hold them to.
Working with TigerStrike
We work with security teams, compliance programmes, and MSSPs across sectors. The common thread is that our customers want continuous evidence rather than annual snapshots, want auditor-ready output rather than scanner noise, and want predictable subscription pricing rather than per-engagement quotes.
If that resonates with your programme, come talk to us. If you are building out a security career, we hire pragmatic engineers who like shipping, writing, and talking to customers.
Get in touch
Book a demo to see TigerStrike against your production attack surface, or write to the team directly.