For customer security reviews
Pass the security questionnaire.
Enterprise customers send long questionnaires before they sign. Most of the hard questions come down to a few pieces of evidence. Cerberon produces them.
Sound familiar?
- Deals stall waiting for a penetration test report.
- Customers ask for an SBOM in a format you have never produced.
- You need to show how fast you fix Critical issues.
- Questions about where your data and code are processed.
The plan
- TodayRun web, API and code scans and download a fingerprinted report.
- This weekExport a signed SBOM and VEX for the product the customer buys.
- Before renewalShow the SLA history and fixed findings from the register.
- When requiredCommission a practitioner-led test for an independent report.
What you can hand over
| They ask for | Cerberon gives you |
|---|---|
| Penetration test or vulnerability scan report | PDF or HTML reports with a SHA-256 fingerprint, or a services engagement. |
| SBOM and VEX | Signed CycloneDX 1.5, SPDX 2.3 and OpenVEX exports. |
| Vulnerability remediation SLAs | Default SLAs of 7, 30, 90 and 180 days by severity, with breach tracking. |
| Data residency for testing | Self-hosted: code and findings stay on your server. |
Questions
Will a Cerberon report satisfy an auditor?
They are reports your ISO 27001 or SOC 2 auditor can use as evidence.
Can I share a report with a customer without giving them an account?
Yes. Create a read-only share link that expires after a set time, optionally masked and watermarked with the recipient's name.
See it on your own systems.
A 30-minute demo on your targets, or install it yourself and start scanning this afternoon.