Questions people ask us first.

Cerberon is an offensive security practice led by Samyam Ray, with 700+ engagements for 200+ clients over 7 years. It delivers network, web, API and mobile penetration testing, cloud and container assessments and secure code review with independent reports. It also makes Cerberon AI, an agentic security platform you install on your own server, which keeps every finding in one register with owners and SLAs.

Small and mid-sized companies where security is one person's second job, or a team of one to three. If customers send you security questionnaires and you have no budget for an enterprise suite, it was built for you.

Yes. It installs with one command on a Linux server or a Windows 11 workstation. Source code, credentials, findings and reports stay on that machine. The network and egress page lists every outbound connection it makes.

No. Rule-based code scanning, secret scanning and dependency analysis run with no AI. Agent-assisted testing uses the provider you choose, or any OpenAI-compatible model you host, with masking before anything leaves.

Every penetration test and assessment gets a fixed quote after a free 30-minute scoping call. Platform licences are quoted per instance, with unlimited users and projects, and the annual licence includes one manual pentest a year. See pricing.

Because it runs on your infrastructure. SaaS tools charge for their cloud compute and storage, mark up the AI they run for you, and charge per seat. With Cerberon you bring the server and your own AI key or model, so there is no hosting bill, no AI markup and no seat count to pay for.

Yes. Your first scan is free: one web app or API, one mobile app, or up to 5 public IP addresses, with a full report. One per company. A person authorised to approve testing signs a letter of authorisation before we start. How the free scan works.

A host with 4 CPU cores, 8 GB of memory and 50 GB of disk, running Ubuntu 22.04 or newer, Debian 12, RHEL or Rocky Linux 9, or Windows 11 22H2 or newer. See system requirements.

Every report comes as PDF, HTML, CSV, SARIF or JSON, with a SHA-256 fingerprint for each version. They are reports your ISO 27001 or SOC 2 auditor can use as evidence.

You can, and they will get you started. The same tools in experienced hands go much further: knowing which findings are real, which roles to test against each other, how to find what gives no visible error, and how to chain small issues into a real attack. Cerberon gives you the agent and the people who know where to look.

Yes. Our security testing services cover network, web, API and mobile penetration testing, cloud and container assessments and secure code review, with a fixed quote after a free scoping call. Vulnerability assessments, red teaming and social engineering are also available.

India, the United States and most other countries. We do not yet sell in the European Union or the United Kingdom.

Because a fair price depends on the scope. Two web apps can differ by ten user roles and a hundred API endpoints. A free 30-minute call gets you a fixed quote, usually the same week, so you never pay for days you did not need.

By the number of targets, user roles and endpoints, the testing window and the reporting you need. The quote is fixed, includes a retest of fixed findings, and does not grow with the job.

Yes. Compliance firms, vCISOs and security consultancies that send regular work get partner rates and can have reports under their own brand. See how partnering works.

No. A licence covers one production instance with unlimited users, projects and scans. A team of 5 and a team of 500 pay the same.

Every capability, every feature update as it ships, priority support for the year, and one manual pentest per licence year, on one web or mobile app. There is no automatic renewal charge.

A one-time purchase of a self-hosted licence. Your licensed version keeps working with every capability, forever, online or air-gapped. It includes 12 months of updates and email support for the first 12 months, with replies within two business days. After that, an optional yearly renewal adds new releases, rule updates and support, and skipping it stops nothing.

The instance becomes read-only after a short grace period, so your findings and reports stay readable. Renewing restores everything, including updates and priority support.

Each licence covers one production instance. Extra instances, such as a second region or an air-gapped copy, are quoted separately.

No. Quotes exclude applicable taxes. We bill in rupees in India and in dollars outside India.

We offer a free scan instead. Your first scan is free: one web app or API, one mobile app, or up to 5 public IP addresses, with a full report. One per company. A person authorised to approve testing signs a letter of authorisation before we start. How the free scan works.

No, not in Scanner mode. Rules and secret scanning run on your Cerberon server. Agent triage sends each finding's rule, path, line and evidence snippet to the AI provider you configure, and deep analysis sends the files the agent reads, both masked first.

JavaScript, TypeScript, Python, Go, Java, Kotlin, C#, C++, PHP, Ruby, Rust, Swift, Scala, Bash, PowerShell, SQL, Lua and Perl, plus infrastructure-as-code and CI configuration files.

Yes. The quality gate fails on any open finding at or above a severity you choose, on new findings only, or on Critical findings older than a set number of days. See CI/CD and quality gates.

CycloneDX 1.5 in JSON or XML, SPDX 2.3 JSON, OpenVEX and CSV. Documents are signed with Ed25519 and the public key is published on your instance.

By severity, then by exploitation: whether the CISA KEV catalogue lists the advisory as exploited, its EPSS probability where published, and whether a fixed version exists.

Yes. Save a registry credential on the scan. It is sealed for the project and never stored in the scan's target or job record.

Yes. Open the recorder, sign in by hand, including MFA or a CAPTCHA, and capture the session. It is held on your server and bound to the address it was recorded on.

Yes. Upload an OpenAPI or Swagger file, a Postman collection or a HAR recording, up to 16 MB. The documented endpoints become the work list, and hosts in the file are rewritten to the base address you submit.

Only if you choose a penetration test. With Vulnerability Assessment Only on, the scan verifies issues without exploiting them and runs no denial of service, brute force or data exfiltration.

An assessment verifies issues without exploiting them and runs no denial of service, brute force, credential stuffing or exfiltration. A penetration test lets the agent exploit to prove a finding, and the report says so.

Up to 256 hosts per submission, entered one per line, comma-separated or as ranges.

It covers the repeatable work between engagements. For a signed-off engagement, red teaming or complex business logic, we run penetration testing services.