SUNNYVALE, Calif., Sept. 01, 2026 (GLOBE NEWSWIRE) -- TiDB, the open-source distributed SQL database powered by PingCAP, today published the results of a rigorous source-code security assessment by NCC Group, one of the world’s leading cybersecurity consultancies. The evaluation identified no critical, high, or medium-severity vulnerabilities, with every issue it surfaced rated Low severity, the lowest rating on the scale. The company also appointed cybersecurity executive Robert Wood as Chief Information Security Officer (CISO).
These announcements reflect a growing trend in enterprise technology. Organizations are applying greater scrutiny to the databases that power AI applications, mission-critical systems, and regulated workloads. Security reviews now begin earlier in the purchasing process, and buyers increasingly expect independent validation before making a decision.
TiDB Clears In-Depth NCC Group Assessment with Every Finding Rated Low Severity
TiDB contracted NCC Group to perform a code-assisted security assessment of the TiDB platform during the summer and fall of 2025.
The engagement was deliberately more demanding than a conventional penetration test. NCC Group’s consultants were given access to the TiDB source code and paired that review with dynamic testing of the running system, examining both the implementation itself and its behavior in a live environment. TiDB came through that review with a strong result. NCC Group identified no critical, high, or medium-severity vulnerabilities. Every issue it surfaced was a common application finding rated Low severity, the lowest band on the scale.
The assessment provides a different level of visibility than a conventional compliance certification. SOC 2 and ISO audits evaluate whether an organization has established and follows defined policies, processes, and controls. NCC Group was given access to the TiDB source code itself, along with the ability to conduct dynamic testing of the running system. That combination allowed the assessment to examine the technology directly, rather than primarily evaluating the controls around how it is developed and operated.
The distinction is particularly important for a distributed database. As the system of record beneath applications and workloads, the database sits at a foundational layer of the technology stack. A vulnerability at that layer can have implications well beyond a single application or service, which makes a clean severity profile at this depth of review a meaningful signal.
TiDB also committed to publishing the complete NCC Group report before the assessment began, regardless of what the findings might show. Rather than releasing only a summary, TiDB is making the full report available so customers, auditors, and security teams can evaluate the findings and methodology directly. Because any assessment reflects a specific version at a point in time, TiDB intends to commission independent reviews on a recurring basis.
Expanded Compliance and Platform Security Controls
The NCC Group assessment complements TiDB’s broader trust program. TiDB undergoes independent audits for SOC 2 and PCI DSS compliance and maintains data-protection practices aligned with ISO standards, GDPR, the EU-U.S. Data Privacy Framework, and HIPAA.
Platform security includes end-to-end encryption, multi-factor authentication, granular access controls, data governance capabilities, and continuous threat detection.
TiDB Cloud Dedicated carries a monthly uptime commitment of at least 99.99 percent. Customers can review certifications, security controls, privacy practices, and service availability through the TiDB Trust Hub.
Veteran Cybersecurity Executive Robert Wood Named CISO
TiDB has appointed Robert Wood as Chief Information Security Officer to lead its growing security organization.
Wood previously served as CISO for technology companies and for a U.S. federal agency whose security program protected data covering more than one hundred million people. He has built enterprise security organizations, led compliance initiatives from SOC 2 through FedRAMP, and earned recognition as CISO of the Year in the SANS Difference Makers Awards.
At TiDB, Wood will oversee product security, cloud infrastructure security, governance, risk management, and compliance. He will also guide the company’s assurance roadmap, including the cadence of future independent assessments, and work directly with customers evaluating TiDB for mission-critical deployments.
Transparency and Independent Validation Meet Rising Enterprise Demands
As distributed databases increasingly support AI agents, operational applications, and business analytics, organizations, especially those in regulated industries, expect transparency, independent validation, and strong governance.
“Trust is earned through transparency and independent validation,” said Max Liu, co-founder and CEO of TiDB. “We handed over our source code and committed to publishing whatever came back before we knew what it would say. Coming through that review with every finding at the lowest severity rating is a result we are proud of, and it is the kind of evidence our customers expect rather than security claims.”
“A source-code assessment is a more demanding form of review than a controls audit, and the teams evaluating a database know the difference,” said Robert Wood, Chief Information Security Officer at TiDB. “Clearing one with no critical, high, or medium-severity findings says something real about how this platform is built. My goal is to keep that standard, put independent review on a regular cadence, and make sure customers get clear answers about how TiDB is built, secured, and governed.”
The complete NCC Group security assessment is available at https://www.nccgroup.com/research/public-report-tidb-security-assessment/.
Customers and prospects can review TiDB’s certifications, controls, privacy practices, and service status through the TiDB Trust Hub at https://www.pingcap.com/trust-hub/.
About TiDB
TiDB, powered by PingCAP, is the distributed SQL database built for AI agents. AI-native companies, leading SaaS providers, and global enterprises run TiDB to support workloads that traditional databases cannot, including millions of tables, persistent agent state, high-concurrency reads and writes, frequent schema changes, and zero-downtime scaling at petabyte scale. With AI-driven innovations across the platform and multi-cloud flexibility, TiDB delivers the resilience, performance, and security organizations need for modern applications. Headquartered in Sunnyvale, California, TiDB serves customers worldwide. Learn more at TiDB.io.
Media Contact
Len Fernandes
Firecracker PR
len@firecrackerpr.com
