Partners
Your clients need a pentest. We can be your testing team.
Send us the scope and we deliver the test, the report and the retest, under your brand if you prefer. You keep the client. Partner rates for regular work.
Who partners with us
- ISO 27001 and SOC 2 consultantsYour client's programme needs an independent pentest before the audit. You keep the programme, we deliver the test.
- vCISOs and fractional CISOsCustomers and boards ask for evidence. Add testing to your retainer without hiring a tester.
- CA and advisory firmsISO work for clients often stops at the technical test. Hand us that part and keep the client.
- Security firms with overflowMore scopes than testers this quarter. Send us the extra work and we test it to your method and template.
What you can count on
The same method, report and retest our direct clients get, arranged around your client relationship.
- Your brand or oursReports under Cerberon's name, or white-label on your template with your logo. Your client sees one firm.
- You own the clientWe talk to your client only as far as you agree, and we never sell to them around you.
- Retest includedEvery engagement includes a retest of what your client fixes, agreed in the quote.
- Reports auditors can useScope, method and limits stated plainly, so your client's ISO 27001 or SOC 2 auditor can use the report as evidence.
- Fixed quote per scopeA fixed price for each engagement, at partner rates for regular work. No day rates that grow with the job.
- NDA before anythingAn NDA with you, and with your client if you need one, before we see a scope.
How it works
- Send the scopeTargets, roles, deadline and the standard your client works towards. We reply within one business day.
- Fixed quoteA fixed price at partner rates and a testing window. Your client signs the letter of authorisation.
- Test and reportHands-on testing to a published method. The report goes to you, on your template or ours.
- RetestYour client fixes, we check the fixes and update the report for the auditor.
What we test for you
Each engagement follows a published method and ends with an independent report.
- Network penetration testingExternal testing shows what the internet sees. Internal testing shows how far an attacker gets once inside. We do both, with proof.
- Web and API penetration testingWe test your application and its APIs the way an attacker would: every role, every endpoint, and the business logic no scanner understands.
- Mobile application security testingWe test the app on real devices as well as statically, including the API it talks to, against OWASP MASVS.
- Cloud security assessmentA read-only review of your cloud accounts, mapped to CIS benchmarks and written for the people who run them.
- Kubernetes and container securityWe review your clusters, images and the pipeline that builds them, so one compromised pod does not become a compromised cluster.
- Secure code reviewTools find the patterns. We read the code where security decisions are made, and explain each issue in your codebase's own terms.
Partner questions
Can the report go out under our brand?
Yes. Send us your template and logo and the report comes out as yours, with the method and limits stated so the auditor can rely on it. If you prefer, it carries Cerberon's name as an independent third party.
How are partner rates set?
On a short call, from the kind of work and how often you send it. Rates are fixed per scope and not published. Regular work gets better rates.
Will you contact our clients directly?
Only as far as you agree. Some partners want us on the scoping call and the readout, others want every message to go through them. We never sell to your clients around you.
Who signs the authorisation to test?
Your client, always. Someone entitled to approve testing of the targets signs a letter of authorisation before any testing starts. We do not test on a partner's word alone.
Who does the testing?
Samyam Ray leads every engagement, with 700+ engagements for 200+ clients over 7 years. When a project needs more hands, trusted testers join under the same method, the same report and the same NDA. You always know who is testing.
What do you need to quote?
The targets (applications, APIs, IP ranges, cloud accounts or repositories), the roles to test as, the deadline and the standard the client is working towards. Send it through the contact form and we reply within one business day.
Send us the next scope.
A short call to agree how we work together, then a fixed quote for your client's test.