Nexus Cerberus
Nexus Cerberus: sovereign AI application security
Nexus Cerberus is sovereign AI application security and posture management with adversarial red-teaming. It registers your AI endpoints and applications, evaluates them against mapped AI failure modes, scans the model supply chain into an AI-BOM, and produces a signed, offline-verifiable risk report, all inside your own estate.
Registered AI estate, inside the customer boundary
Model endpoints
- openai-compatible/gateway
- internal-inference/chat
- hosted-provider/completion
- embeddings/service
Applications and agents
- claims-assistant
- case-triage-agent
- knowledge-search
- back-office-copilot
Model supply chain
- model artifacts
- dependencies
- provenance
- licence
- serialized formats
Every registered surface carries ownership, model and provider context, and environment, so posture and assessment history are attached to a named system rather than a hostname.
- OpenAI-compatible and HTTP-accessible targets
- Any AI endpointOpenAI-compatible and HTTP-accessible targets
- model artifacts, dependencies and provenance
- AI-BOMmodel artifacts, dependencies and provenance
- LLM Top 10 categories tagged to MITRE ATLAS
- OWASP + ATLASLLM Top 10 categories tagged to MITRE ATLAS
- offline-verifiable evidence bundle
- Signed reportoffline-verifiable evidence bundle
The buyer problem
The AI estate is growing faster than the assurance around it.
AI is arriving through several routes at once: hosted providers, internally hosted models, embedded application features and agents that hold real permissions. Security teams are accountable for all of it, and rarely have a single list of what exists.
Where assurance breaks down
- No consistent inventory of AI endpoints, applications, agents and owners
- No supply-chain view of the model artifacts and dependencies in use
- Adversarial testing happens once, manually, if it happens before release
- Results are informal, so they cannot be handed to audit or a regulator
- Testing tools require sending prompts and findings to an external service
What Cerberus establishes
- A registry of AI systems with ownership, model, provider and environment
- An AI-BOM covering artifacts, dependencies, provenance and licence
- Repeatable adversarial testing mapped to recognised AI failure modes
- Signed reports and evidence bundles a third party can verify offline
- Every step executed inside the customer estate, with no external LLM API
Product definition
One product across registry, adversarial evaluation and evidence.
Cerberus is an AI application security and posture management product. It holds the inventory, performs the testing and produces the record, so AI assurance is a single governed process rather than three disconnected exercises.
AI registry and posture management
Register every reachable AI endpoint, application and agent, attach ownership, model, provider and environment context, and maintain a continuous posture view of the estate as it grows.
Adversarial evaluation and red-teaming
Run mapped adversarial test families against registered targets, judged by layered detectors and local judge models, with results organised by OWASP LLM Top 10 category and tagged to MITRE ATLAS.
AI-BOM, evidence and signed reporting
Build a bill of materials for models and dependencies, correlate findings with remediation guidance, and produce a signed PDF and JSON report with an evidence bundle that can be verified offline.
Sovereign and offline-first by construction
Assessment workflow
From registration to signed evidence, in one governed sequence.
Each step produces something the next step depends on: identity, context, composition, scope, results, correlation, evidence and, where you want it, a pipeline decision.
Register the endpoint or application
Add an OpenAI-compatible or HTTP-accessible target, or an AI application or agent, so the system under assessment has a stable identity in the registry.
Capture ownership and context
Record the owning team, the model and provider behind the endpoint, and the environment it runs in, so posture and findings are attributable to a named system and a named owner.
Scan model artifacts and dependencies
Inspect the model artifacts and software dependencies behind the target to build the AI-BOM, including provenance, version, licence position and unsafe serialized formats.
Configure the assessment scope
Choose the test families, intensity and window for the run. Assessment executes only against registered targets and only within the scope you configure.
Run mapped adversarial tests
Sandboxed, network-restricted workers execute the selected test families against the target, with responses judged by layered detectors and local judge models.
Correlate findings and remediation
Results are deduplicated and correlated across tests, mapped to OWASP LLM Top 10 categories, tagged to MITRE ATLAS and paired with concrete remediation guidance.
Produce the signed report and evidence bundle
The assessment is packaged as a signed PDF and JSON report plus an evidence bundle that recipients can verify offline and check for tampering.
Gate the pipeline where required
Run the same assessment from the command line as a build step and apply policy-based exit codes, so a breach of your policy fails the pipeline instead of reaching production.
Capabilities
What Cerberus does.
An assurance capability for AI systems, spanning the application, its behaviour under adversarial pressure and the supply chain behind it.
Endpoint, application and agent registration
Register OpenAI-compatible and HTTP-accessible AI endpoints, and AI applications and agents where they expose a reachable interface, as first-class assets with owners and environments.
Continuous AI posture inventory
Maintain a live inventory of the AI estate: what exists, who owns it, what model sits behind it, when it was last assessed and what its current risk position is.
AI-BOM and model supply chain
Compose a bill of materials across model artifacts and dependencies with provenance, version and licence information, and flag unsafe serialized formats that can execute code on load.
Red-teaming mapped to OWASP LLM Top 10
Test families cover categories including direct and indirect prompt injection, sensitive information disclosure, excessive agency and system prompt leakage, with additional jailbreak and toxicity testing where supported.
Findings tagged to MITRE ATLAS
Each finding carries a MITRE ATLAS tag alongside its OWASP category, so AI risk can be discussed in the same adversarial language as the rest of the security programme.
Layered detectors and local judge models
Deterministic checks, pattern and heuristic detectors and locally hosted judge models combine to produce a verdict, without any dependency on an external model service.
Concrete remediation guidance
Every finding is paired with guidance an engineering team can act on: what was demonstrated, why it matters and the control changes that close it.
Console and CLI with policy-based CI gating
Operate interactively through the console or non-interactively from the command line, with policy thresholds expressed as exit codes so pipelines can enforce them.
Signed reports and evidence bundles
Deliver a signed PDF and JSON report plus an evidence bundle, offline-verifiable and tamper-checked, so an auditor can rely on the record without re-running the work.
Framework mapping
Test families organised by OWASP LLM Top 10, findings tagged to MITRE ATLAS.
MITRE ATLAS is the external adversarial threat framework for AI systems. It is used here only as a tagging framework for findings.
| Test family | OWASP LLM Top 10 | MITRE ATLAS tag |
|---|---|---|
| Direct prompt injection | Prompt injection | Tagged to MITRE ATLAS |
| Indirect prompt injection | Prompt injection | Tagged to MITRE ATLAS |
| Sensitive information disclosure | Sensitive information disclosure | Tagged to MITRE ATLAS |
| System prompt leakage | System prompt leakage | Tagged to MITRE ATLAS |
| Excessive agency and tool misuse | Excessive agency | Tagged to MITRE ATLAS |
| Jailbreak and toxicity testing | Applied where supported | Tagged to MITRE ATLAS |
Detection
Layered detectors and local judge models decide the verdict.
Exact conditions that can be decided without interpretation: leaked system prompt content, disclosed secrets, malformed policy responses and known unsafe artifact formats.
Signal-based detection across response content and behaviour, used to catch the variations that a fixed rule set alone would miss.
Locally hosted models assess ambiguous responses against the intent of the test, keeping the judgement step inside the same boundary as the data being judged.
Related results across test families are grouped into a single finding, so remediation owners receive distinct issues rather than repeated variations of one.
Detectors and judge models run inside the deployment boundary. No prompt, response or finding needs to be sent to an external model service for a verdict to be reached.
Model supply chain
An AI-BOM for the artifacts and dependencies behind the application.
AI-BOM composition
Illustrative
- claims-assistantAI applicationRegistered
- model artifactprovenance recorded, licence identified
- serialized weightsformat inspectedUnsafe format flagged
- inference runtimeversion pinned
- retrieval dependencytransitive dependencies resolved
- tokeniser packagelicence identified
- agent tool bindingscapability surface recordedAgency review
Authorisation
Testing runs against registered targets
Method
Sandboxed, network-restricted workers
Policy
Assessment results guide release decisions
Findings and evidence
Every finding is traceable from endpoint to signed evidence.
A result is only useful if someone else can act on it and rely on it. Cerberus records the path from the registered system, through the test and the detector, to the framework mapping, the remediation and the signed bundle.
One finding, traced end to end
Illustrative structure of a single result, not a customer assessment
- 01Endpointclaims-assistant / productionA registered application with a named owner, model, provider and environment.
- 02Testindirect prompt injection via retrieved documentA mapped test family selected in the configured assessment scope.
- 03Detectorpolicy-violation detector + local judge modelLayered detection produces the verdict locally, with the evidence retained.
- 04MappingOWASP LLM01 · MITRE ATLAS tagThe finding is placed in a framework your risk and assurance teams already use.
- 05Remediationretrieval content isolation and tool scope reductionSpecific control changes rather than a generic severity score.
- 06Evidencesigned report + evidence bundlePackaged, signed and verifiable offline by a recipient outside the security team.
Illustrative assessment summary
Representative structure, not a live customer assessment
- claims-assistant / productionIndirect prompt injection, retrieval pathConfirmed, priority 1
- case-triage-agent / productionExcessive agency via tool bindingConfirmed, priority 1
- knowledge-search / stagingSystem prompt leakage under paraphraseConfirmed, priority 2
- model artifact / claims-assistantUnsafe serialized format detectedSupply chain, priority 2
- back-office-copilot / stagingToxicity thresholds within policyNo finding
Priority reflects the demonstrated behaviour and the role of the system, not a generic model score. Supply-chain results appear alongside behavioural findings in the same report.
The report is delivered as signed PDF and JSON with an accompanying evidence bundle. Both the signature and the bundle can be verified offline, so a recipient can confirm the record has not been altered without contacting a service.
Use cases
Where Cerberus is bought, and the decision it supports.
Cerberus is usually acquired to answer an accountability question about a specific AI system, then extended across the estate as the inventory grows.
Before go-live
Pre-acceptance security testing
Assess an AI application against mapped test families before it is accepted into production, and hand the signed report to the accepting authority.
Assurance
AI application and agent assurance
Test the behaviour of applications and agents, including their tool bindings and retrieval paths, rather than the underlying model in isolation.
AI-SPM
Continuous posture across a growing estate
Keep an accurate inventory of AI endpoints, owners and assessment status as teams across the organisation deploy more AI systems.
AI-BOM
Model supply-chain review
Understand what a model actually brings with it: artifacts, dependencies, provenance, licence position and unsafe serialized formats.
CI
DevSecOps regression gate
Run assessments as a pipeline step with policy-based exit codes, so an AI regression fails a build instead of reaching users.
Public sector, defence, finance, healthcare
Regulated and sovereign environments
Run the whole assurance cycle inside a controlled or air-gapped boundary, with evidence that stands up to external scrutiny.
Why Cerberus
Sovereign testing, supply-chain depth and evidence that travels.
The distinction is not the number of attack prompts. It is where the testing runs, how deep it looks and whether the output can be relied on by someone who was not involved.
Sovereign and offline-first
Corpora, detectors and judge models operate inside the deployment boundary. There is no external LLM API in the assessment path, which makes the product usable in classified, regulated and disconnected environments where sending prompts outside is simply not permitted.
Tests the application and its model supply chain
Behavioural testing alone misses the artifacts, dependencies, licence position and unsafe serialized formats that arrive with a model. Cerberus assesses both, and reports them together against the same registered system.
Framework-mapped evidence, not just a score
Findings sit in OWASP LLM Top 10 categories and carry MITRE ATLAS tags, with remediation guidance attached, so the output integrates with existing risk registers and assurance processes instead of forming a parallel one.
Local detectors and judge models
Deterministic checks, heuristic detectors and locally hosted judge models combine to reach a verdict, keeping both the data and the judgement inside your boundary.
Signed, offline-verifiable outputs
The signed report and evidence bundle can be checked for integrity by an auditor, accrediting authority or customer without re-running the assessment and without network access.
Powered by Nexus
Orchestration, approvals, integrations, secret handling and audit logging come from the Nexus execution and governance engine embedded in the product. Cerberus is sold standalone, and the engine is included rather than purchased separately.
Powered by Nexus
Built on the same execution layer we sell as a platform.
Cerberus inherits the workflow engine, approval model and append-only audit trail used across the Nexus product line. That is why assessment runs, policy changes and evidence access are recorded as governed actions, and why CI gating, ticketing and escalation fit the systems you already operate.
You do not need to buy or implement the Nexus platform to run this product. The shared foundation is why the product deploys into your environment, keeps its data local and produces an audit record you can inspect.
Explore the Nexus platformDeployment and trust
Runs entirely inside the environment you control.
Deployment topology, identity, secrets, transport and audit are inherited platform capabilities rather than product-specific additions.
- Deployment model
- Self-hosted only, in your own infrastructure. Cerberus is not operated as a shared external service.
- Topologies
- Single-node deployment for smaller estates, and Kubernetes or OpenShift for clustered and multi-team operation.
- Network posture
- Air-gapped and disconnected operation supported. Attack workers are sandboxed and network-restricted.
- Identity and access
- OIDC and SAML single sign-on, role-based access control and tenant isolation across registry, assessments and evidence.
- Secrets and transport
- Vault-backed secret storage where supported, and mTLS between components.
- Audit
- Append-only audit logging over registration, assessment runs, policy changes, report generation and evidence access.
- Framework alignment
- Testing and reporting are mapped to the OWASP LLM Top 10 and tagged to MITRE ATLAS, and evidence output is designed to align with common regulatory and assurance frameworks. Cerberus does not confer certification.
Framework references describe how testing and evidence are mapped or aligned. They are not claims of certification, accreditation or third-party attestation.
Questions
Registry, residency, control and integration.
Cerberus briefing
Know what AI you run, how it fails under pressure, and be able to prove it.
A Cerberus briefing covers registry and posture, the adversarial test families and their framework mapping, AI-BOM and supply-chain scanning, CI gating and the signed evidence output, along with deployment options for your environment.