About
You talk to the person who tests your systems.
Cerberon is an offensive security practice led by Samyam Ray. No sales team, no juniors learning on your app, no handoffs between the person you scoped with and the person who tests.
- 700+engagements delivered
- 200+clients tested for
- 10,000+hours of hands-on security work
- 7 yearsin defensive, offensive and GRC roles
Close to 7 years in security, across three seats. I have built the foundations, tried to break the systems, and worked on governing the risk around them. That is why my reports are written for the engineer who fixes the issue and for the auditor who reads the evidence.
- DefendingFirewalls, VPN, IDS and IPS, endpoint security, Active Directory hardening and security operations. Where you learn how systems are meant to hold.
- AttackingNetwork, web, API, mobile, thick-client and cloud penetration testing, vulnerability assessments, red teaming and social engineering for enterprise clients, including banking and insurance organisations.
- GoverningISO 27001, SOC 2 Type II and ISO 42001 programmes, PCI DSS scoping, third-party risk, customer security questionnaires and privacy work. Where you learn what auditors and enterprise buyers actually check.
Certifications
- Certified Penetration Testing Professional
- Certified Red Team Expert
- Google Professional Cloud Security Engineer
- Oracle Cloud Infrastructure Certified Security Professional
- Certified AppSec Practitioner
- Certified Cloud Security Practitioner (AWS)
- Certified LLM Security Expert
- ISO/IEC 27001 Information Security Associate
How Cerberon works
I lead every engagement, from the scoping call to the report walkthrough. When a project needs more hands, trusted testers I have worked with join under the same method, the same report format and the same NDA, and you know who they are before testing starts.
I also built Cerberon AI, the agent I test with. It runs the reconnaissance, enumeration and checklist work that fills days of a typical pentest, so my hours go on business logic, access control and chained attacks. You pay for testing, not padded days.
What we believe
- Evidence or it did not happen.Every finding shows its proof, and what was not tested is never reported as clean.
- A fixed price.Agreed after a free call, with the retest included. It does not grow with the job.
- Authorisation first.Nothing is tested before a signed letter of authorisation and an agreed scope.
- Your data stays yours.Findings and evidence are handled under NDA and kept only as long as you agree.
Tell us what you need tested.
A free 30-minute scoping call, then a fixed quote.