# Cerberon

> Cerberon is an offensive security practice. It delivers network, web, API and mobile penetration testing, cloud and container security assessments and secure code review, each with a fixed quote after a free scoping call and an independent report with a retest. The testing is led by Samyam Ray, with 700+ engagements for 200+ clients over 7 years. Cerberon also makes Cerberon AI, an agentic security platform that runs penetration tests, SAST, DAST, cloud, container, vulnerability assessment, SCA and SBOM checks from your own server.

Cerberon (cerberon.dev) is an offensive security practice in Chennai, India. It delivers penetration testing and security assessments, and makes Cerberon AI, an agentic security platform.

Descriptor: Penetration testing and security assessments, with an AI agent built in. Cerberon leads with expert services: penetration testing and security assessments led by Samyam Ray, with 700+ engagements for 200+ clients over 7 years. It also makes the platform Cerberon AI, an agentic security platform that runs on the customer's own server.

Cerberon sells to businesses in India, the United States and most other countries (not yet the EU or UK). Prices are not published: every engagement and licence gets a fixed quote after a free 30-minute call. Licences cover one instance with unlimited users and projects, and the annual licence includes one manual pentest per licence year, on one web or mobile app. Compliance and security firms can partner for regular or white-label testing. Free scan: Your first scan is free: one web app or API, one mobile app, or up to 5 public IP addresses, with a full report. One per company. Details: https://cerberon.dev/free-scan.

## Services
- [Network penetration testing](https://cerberon.dev/services/network-penetration-testing): External testing shows what the internet sees. Internal testing shows how far an attacker gets once inside. We do both, with proof.
- [Web and API penetration testing](https://cerberon.dev/services/web-application-penetration-testing): We test your application and its APIs the way an attacker would: every role, every endpoint, and the business logic no scanner understands.
- [Mobile application security testing](https://cerberon.dev/services/mobile-application-security-testing): We test the app on real devices as well as statically, including the API it talks to, against OWASP MASVS.
- [Cloud security assessment](https://cerberon.dev/services/cloud-security-assessment): A read-only review of your cloud accounts, mapped to CIS benchmarks and written for the people who run them.
- [Kubernetes and container security](https://cerberon.dev/services/kubernetes-container-security): We review your clusters, images and the pipeline that builds them, so one compromised pod does not become a compromised cluster.
- [Secure code review](https://cerberon.dev/services/secure-code-review): Tools find the patterns. We read the code where security decisions are made, and explain each issue in your codebase's own terms.
- [Vulnerability assessment](https://cerberon.dev/services/vulnerability-assessment): A verified, prioritised list of weaknesses across your estate, without exploitation, so you know what to fix first and can show customers you checked.
- [Red teaming](https://cerberon.dev/services/red-teaming): A red team pursues a goal, such as reaching customer data, the way a real attacker would, and shows whether your team notices.
- [Social engineering](https://cerberon.dev/services/social-engineering): We run the same phishing, phone and pretext attacks real adversaries use, measure who clicks, reports or hands over credentials, and train your team on what we found.

## Platform
- [Penetration testing](https://cerberon.dev/platform/penetration-testing): The agent maps what you expose, picks the right tests, attacks like an adversary and reports only what it can prove. Exploitation happens only when you allow it.
- [SAST](https://cerberon.dev/platform/sast): The agent reads your code for flaws no rule can express. Our 3,676 rules give the same answer on every commit, in CI and offline. It all runs on your server, so your source never leaves it.
- [DAST](https://cerberon.dev/platform/dast): An agent signed in as every role works through the complete OWASP Web Security Testing Guide against every function it finds, on top of crawling, active scanning and known vulnerability checks.
- [Cloud security](https://cerberon.dev/platform/cloud-security): Audit every cloud account with read-only keys that never leave your server. Each finding names the CIS control it fails, so your cloud team knows exactly what to change.
- [Container security](https://cerberon.dev/platform/container-security): Check your clusters against the CIS Kubernetes Benchmark and scan the images you ship for known exploited packages, in the same tracker.
- [Vulnerability assessment](https://cerberon.dev/platform/vulnerability-assessment): A full assessment of your hosts and services that verifies every issue without exploiting anything. Run it monthly instead of once a year.
- [SCA](https://cerberon.dev/platform/sca): Every dependency you ship, matched against OSV advisories and ranked by what attackers are exploiting right now, with the version that fixes it.
- [SBOM, CBOM and VEX](https://cerberon.dev/platform/sbom): The documents customers and regulators ask for, generated from the scans you already run and signed by your own instance.
- [Vulnerability tracker and Threat Advisor](https://cerberon.dev/platform/vulnerability-tracker): Every finding from every scan becomes one tracked item with an owner, an SLA and proof. Threat Advisor tells you where to start each morning.
- [Private AI](https://cerberon.dev/platform/private-ai): Cerberon runs where your code and data already live. Use the AI provider you trust, a model you host yourself, or no AI at all.

## Choosing
- [Self-hosted vs SaaS security testing](https://cerberon.dev/compare/self-hosted-vs-saas-security-testing)
- [Continuous testing platform vs an annual penetration test](https://cerberon.dev/compare/platform-vs-annual-pentest)
- [One licence for testing and a pentest vs two separate vendors](https://cerberon.dev/compare/platform-and-pentest-vs-separate-vendors)
- [An enterprise suite alternative for small teams](https://cerberon.dev/compare/enterprise-vulnerability-management-alternative)
- [Security for the person who was handed security](https://cerberon.dev/solutions/accidental-ciso)
- [Answer customer security questionnaires with real evidence](https://cerberon.dev/solutions/security-reviews)
- [Security testing in your CI/CD pipeline](https://cerberon.dev/solutions/devsecops)

## Company
- [Pricing](https://cerberon.dev/pricing)
- [Free scan](https://cerberon.dev/free-scan)
- [Partners](https://cerberon.dev/partners): white-label and subcontracted testing for compliance and security firms
- [About](https://cerberon.dev/about)
- [Security](https://cerberon.dev/security)
- [FAQ](https://cerberon.dev/faq)
- [Contact](https://cerberon.dev/contact)

## Documentation
- [Cerberon documentation](https://docs.cerberon.dev): installation, scanning, administration, API and CI/CD
- [Documentation for AI assistants](https://docs.cerberon.dev/llms.txt)

## Optional
- [Full text of this site](https://cerberon.dev/llms-full.txt)