Skip to Content
Introduction

Introduction to Cerberus

Cerberus is a modern, cross-platform cybersecurity intelligence platform designed to protect private local networks and Linux endpoints.

Think of your local network like an office building. Most security tools only check who comes in the front door, or only monitor people already sitting at their desks. Cerberus does both: it constantly maps every physical and wireless device in the building (Network Sentinel), while simultaneously placing a low-profile security guard inside Linux servers (eBPF Agent) to watch for suspicious behavior.

Scanning Performance
60x Faster
+5900%Full 1-65535 port audit in 12s vs 12m

Why Cerberus Was Built

Traditional network security usually requires choosing between two incomplete approaches:

  1. Active Network Scanners (like standard Nmap): Great at probing open ports, but painfully slow when auditing all 65,535 ports. They cannot see inside machines to detect in-memory malware or stolen credentials.
  2. Endpoint Detection Agents (like Osquery or Falco): Powerful on the machines where they are installed, but completely blind to unmanaged devices like smart TVs, IoT cameras, printers, and visiting smartphones.

Cerberus bridges this gap into a single, unified pane of glass:

01Under 1.5s

Stage 1: L2 / ARP Mapping

Active broadcast UDP prods wake power-saving devices. Direct kernel neighbor tables (Netlink/sysctl/IPNetTable) harvest MACs and sleeping hosts.

Engine:Raw Link Layer
022 to 4 seconds

Stage 2: High-Speed Port Sweep

RustScan sweeps all 65,535 TCP ports simultaneously using adaptive socket batches. Gracefully falls back to Nmap when RustScan is unavailable.

Engine:RustScan / Nmap
03Targeted (< 10s)

Stage 3: Targeted Deep Audit

Nmap runs service version detection (-sV) and NSE scripts (vulners) ONLY on verified open ports from Stage 2. Eliminates wasted probes on closed ports.

Engine:Nmap + Vulners NSE
Total Scan Duration: 5–15 seconds for a standard /24 subnet (vs 8–15 minutes for vanilla nmap).60x Speedup

High-Level Benefits

For Non-Technical Stakeholders

  • Plain-English Device Names: Instead of confusing numbers like 192.168.1.144 or obscure MAC addresses, Cerberus identifies "Alice's MacBook Pro (macOS)" or "Living Room Smart TV (LG webOS)".
  • Fleet Posture Rating (0–100): A single health score representing your fleet’s overall security posture. If a machine exposes a critical vulnerability or a suspicious reverse shell, the score drops immediately.
  • 100% Private & Local: All scan data, device history, and security events stay on your local machine in an embedded SQLite database. No credentials or logs are uploaded to any external cloud.

For Security Engineers

  • Tri-Stage Hybrid Engine (internal/scanner): Merges Layer-2 ARP sweeps, RustScan socket multiplexing, and targeted Nmap version audits into one non-overlapping pipeline.
  • Kernel-Level eBPF Telemetry: Collects process executions, memory injections, and interactive commands on Linux with sub-millisecond overhead.
  • Deterministic ATT&CK Rules: Replaces fuzzy alert noise with deterministic rules mapped to MITRE ATT&CK tactics (webshells, ptrace injection, privilege escalation).
Full Subnet Discovery Time (/24 Subnet)
1.8s(Target: < 3.0s)

Prods sleepy mobile devices and parses kernel neighbor tables directly.

Full Port Sweep (1-65535 TCP ports)
4.2s(Nmap: ~480s)

RustScan adaptive batching eliminates wasted timeouts on closed ports.

Quick Navigation

Ready to explore how Cerberus works under the hood?

Last updated on
Overview & Capabilities