The AI-powered autonomous security platform for your whole attack surface
Know your security debt
before lunch.
An agent that tests every release.
An expert who pentests every year. One purchase.
- Self-hosted, air-gap ready
- Enterprise-grade security
- Your own AI, or none
- Unlimited users
- Manual pentest included
Your pentest report in not weeks buthours.
Install at 9, get your report by 12.
$ curl -fsSL https://license.cerberon.dev/install.sh | sh
Checking this host: 4 cores, 16 GB memory, 120 GB free
Verifying the release signature
Installing Cerberon and the scanner tools
Serving HTTPS on port 443
Cerberon is running at https://sec-01.internal
New ScanScan Details
Scan typeCodeWeb & APIHostCloudMobile
Targethttps://app.example.com
EngineScanner + Agent
Sign-inLog in with a browser
I am authorised to test every target in this scan
Start scan
Coverage57 of 57 OWASP cases
CriticalAnother customer's order readable by changing its ID
HighPassword reset token accepted twice
HighCloud access key committed to the repository
MediumSession cookie sent without the Secure flag
Findings6 open · 1 due this week
CriticalAnother customer's order readable by changing its ID
HighPassword reset token accepted twice
HighCloud access key committed to the repository
MediumSession cookie sent without the Secure flag
MediumStack trace returned on malformed JSON
LowServer version disclosed in response headers
Another customer's order readable by changing its ID
Evidence
GET /v1/orders/1043 as customer 2207: 200 OK, owner 1388StandardOWASP API1:2023 · CWE-639
StateTo fix
OwnerBackend team
SLADue in 7 days
Download reportCheckout web app and API · version 2
FormatPDFHTMLCSVSARIFJSON
LayoutStandard report
CopyFullMasked
SHA-256 fingerprint9f2c41a70be377d1c58e2a906d14e3b2
Download
Report downloaded. Ready to send to your customer.
Small-team security is broken. We fixed it.
The old way
- PentestsOnce a year, stale by the next release
- ToolsFive scanners, five dashboards
- PricingPer seat, per project, per asset
- Your dataCode and findings on someone else's cloud
- Where to startA 400-row spreadsheet
- ReportsWeeks after the test
With Cerberon
- PentestsAn agent every release, an expert every year
- ToolsOne agent, one tracker
- PricingOne price, unlimited everything
- Your dataNever leaves your server
- Where to startFive things to fix today
- ReportsBefore lunch
Eight kinds of testing. One agent. One install.
Penetration testing
A pentester that never clocks out.
- Web, API and network targets
- Up to 256 hosts per scan
- CVSS 3.1 and a reproducible request on every finding
Edge hosts
Penetration test · 3 hosts · 11 services
| Host | Service | Finding |
|---|---|---|
| 203.0.113.10 | 443 https | Medium TLS 1.0 accepted |
| 203.0.113.10 | 22 ssh | Low Password login enabled |
| 203.0.113.11 | 8443 https | High Admin console exposed |
| 203.0.113.11 | 3306 mysql | High Reachable from internet |
| 203.0.113.12 | 80 http | No issue |
CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Code, secrets and IaC
Find the bug before it ships.
- 18 languages, Terraform, Kubernetes, Dockerfiles and CI files
- The agent finds what rules cannot, and confirms each finding
- Source code never leaves your server
SQL query built from request input
payments-service · src/orders/search.py · line 42
40 def search(request):
41 term = request.args.get("q")
42 rows = db.execute(f"SELECT * FROM orders WHERE ref = '{term}'")
43 return jsonify(rows)Rulecerberon.python.sqli.fstring-query
StandardCWE-89
Agent triageConfirmedRequest input reaches the query unbound.
Web and API testing
Every OWASP test. Signed in, as every role.
- OpenAPI, Postman, HAR and GraphQL
- Multi-role, MFA-ready sign-in
- Coverage ledger, never a silent gap
Coverage ledger
OWASP WSTG v4.2 · every test
| Category | Tested | Not applicable | Blocked |
|---|---|---|---|
| Information gathering | 10 | 0 | 0 |
| Configuration | 9 | 2 | 0 |
| Identity | 4 | 1 | 0 |
| Authentication | 9 | 1 | 0 |
| Authorisation | 4 | 0 | 0 |
| Sessions | 8 | 1 | 0 |
| and 6 more categories · 81 tested · 16 not applicable · 1 blocked | |||
Blocked: file upload needs a test account with upload rights
Cloud security assessment
Read-only audits. Real CIS controls.
- IAM, privilege escalation paths and public storage
- Keys encrypted with AES-256-GCM
- Never creates, changes or deletes a resource
AWS production account
Read-only audit · eu-west-1, us-east-1
| CIS control | Check | Result |
|---|---|---|
| 1.4 | No access keys on the root user | Pass |
| 1.10 | MFA for every console user | Fail |
| 2.1.4 | Block public access on S3 buckets | Fail |
| 3.1 | CloudTrail enabled in all regions | Pass |
| 5.2 | No security group open to 0.0.0.0/0 on admin ports | Fail |
CIS AWS Foundations Benchmark v3.0
Container security assessment
One bad pod should not own your cluster.
- Managed or self-hosted clusters
- Private registries supported
- Scope a scan to one namespace
Cluster prod · namespace payments
Kubernetes posture and image scan
| Check | Workload | Result |
|---|---|---|
| CIS 5.2.2 privileged container | ledger-worker | Fail |
| CIS 5.1.3 wildcard role | ci-deployer | Fail |
| CIS 5.3.2 network policy | payments | Missing |
| Image: openssl 1.1.1k | api:2.4.1 | CVE-2021-3711 |
| CIS 5.1.6 service account token | web | Pass |
Vulnerability assessment
Know every weak spot. Exploit none.
- Zero exploitation, zero brute force
- Every issue verified and ranked by CVSS
- Every unchecked item named, never hidden
Monthly VA · 24 hosts
Vulnerability Assessment Only · no exploitation
Hosts24
Open services61
Known CVEs17
Critical2
CriticalVPN gateway with a critical remote code execution CVE10.0.0.4
HighDatabase port open to the internet203.0.113.11
MediumTLS 1.0 still accepted203.0.113.10
Software composition analysis
Know which library will hurt you first.
- npm, PyPI, Maven, Go, NuGet, Cargo, Composer, RubyGems
- Container images and private registries
- VEX statuses backed by evidence
Advisories by exploitability
payments-service · 214 components
| Component | Advisory | Signal | Fix |
|---|---|---|---|
| log4j-core 2.14.1 | CVE-2021-44228 | Known exploited | 2.17.1 |
| jackson-databind 2.9.8 | CVE-2019-12384 | EPSS 0.71 | 2.9.9.1 |
| lodash 4.17.15 | CVE-2020-8203 | EPSS 0.03 | 4.17.19 |
| openssl 1.1.1k | CVE-2021-3711 | EPSS 0.12 | 1.1.1l |
| python 3.7 | End of life | No fixes | 3.12 |
CycloneDX 1.5 · SPDX 2.3 · OpenVEX · signedDownload
SBOM, CBOM and VEX
Hand over the BOM before they ask twice.
- CycloneDX 1.5, SPDX 2.3 and OpenVEX
- CycloneDX 1.6 CBOM with quantum security levels
- CERT-In SBOM and CBOM fields
SBOM / CBOM
payments-service 2.4.1 · 214 components · 38 algorithms
| Document | Format | Export |
|---|---|---|
| Software BOM | CycloneDX 1.5 JSON | Download |
| Software BOM | SPDX 2.3 | Download |
| Exploitability | OpenVEX | Download |
| Cryptographic BOM | CycloneDX 1.6 | Download |
CERT-In SBOM and CBOM fields filled where observed
Tracker and Threat Advisor
Every vulnerability, from found to fixed, in one place.
See what hurts you most today, and fix that first.
See the trackerhttps://sec-01.internal/advisor
Threat Advisor
All projects · today
The five fixes to make today.
CriticalOrder IDs readable across customersBreached
CriticalKnown exploited VPN CVEBreached
HighPublic storage bucket4 days
HighExploited logging library5 days
HighAdmin console exposed6 days
Which assets bleed the most. Risk
APIapi.example.com
Codepayments-service
Cloudaws: production
Networkvpn.example.com
Mobilecom.example.wallet
Enterprise controls
Enterprise-grade security. Not enterprise pricing.
Made to pass your customer's security review. Every control in every licence.
How we secure CerberonSecurity controls9/9 checked
SSO
MFA
Granular RBAC
Project isolation
Self-hosted
Air-gapped
Privacy gate
Audit trail
Asset inventory
Runs on one server
- 4 cores, 8 GB, 50 GBThe minimum host. Each running scan reserves 2 to 4 GB of memory on top.
- Linux or Windows 11Ubuntu 22.04 or newer, Debian 12, RHEL or Rocky Linux 9, or Windows 11 22H2 or newer.
- One commandThe installer sets up Docker, HTTPS and the scanner tools, and keeps your data across updates.
- Online or air-gappedInstall from an offline bundle where the host has no internet access.
Expert services
The agent does the checklist. A human does the rest.
Every annual licence includes a manual pentest, led by the same practitioner who tests for our services clients. Need more? Networks, cloud, mobile and more, with a fixed quote after a free scoping call.
Free scan
Don't trust us yet? Get your first scan free.
Your first scan is free: one web app or API, one mobile app, or up to 5 public IP addresses, with a full report. One per company. See real findings from your own systems before you spend anything.
One free scan and one report per company.
- Tell us what to scanPick one web app or API, one mobile app, or up to 5 public IP addresses, and send it through the contact form.
- Sign the authorisationA person authorised to approve testing signs our letter of authorisation, with proof you own the target.
- Get your reportWe run the scan and send you the full report.
Give us 30 minutes. We will find something.
A live demo on your own targets, with an engineer on the call. We reply within one business day.
Book a demo