Company
Security for the identities that act without a person present.
Cerberus builds behavioral security for machine and agent identities. Software increasingly authenticates as itself — services, pipelines, agents — and the credentials it carries are valid long after anyone is watching how they are used. Cerberus is the layer that keeps watching, after authentication, without ever standing in the way.
How Cerberus is run
Claims you can check
Every detection threshold on this site is read from the values the detector itself uses, and each published limit is tied by a test to the code that makes it true, so neither can quietly drift.
Observation before action
Cerberus never sits in your request path and never acts on a credential. It gives you evidence; the decision stays with the team that owns the identity.
Narrow before broad
One detector ships, with its limits published, before a second is described. Capabilities that are built but not enabled are labelled that way.
Privacy as a constraint
The system is designed so that it cannot receive content, raw credentials or raw addresses — not merely promised not to keep them.
Stage
Cerberus is early-stage and founder-led. The production service is live, and new deployments begin with a technical validation on the customer’s own traffic.
No third-party security audit or certification has been completed yet. The controls that exist today are described on the security page, and what the detector does not catch is published under Known limits.
Contact
Request access, discuss an integration, or write to hello@cerberushq.dev.