Starting your first pentest

This guide walks you through setting up and running your first pentest with Cerberus.

​

Step 1: Open the Pentesting section

After logging in, you land on the Dashboard - an overview of all your operations: vulnerabilities found, assets covered, security score, and trends over time. Open Pentesting in the left-hand menu. The section has a few sub-tabs:

• Sessions - launch pentests and review previous runs
• Infrastructure - the asset map and the relationships between assets
• Overview - aggregate statistics for your testing scope

Once a pentest starts, updates show up here: which assets are being tested, which vulnerabilities are found, and which attacks were blocked.

​

Step 2: Run your first prompt

Go to the Sessions tab within Pentesting. From here you can:

• Run automated pentesting with AutoPT
• Check for vulnerabilities
• Automate reconnaissance
• Run OSINT against people with Auto-OSINT

The right panel shows your available assets. Click on them to add them to your prompt. The Executions tab shows all previous runs. There are two ways to create a new AutoPT session:

• From a template - pick one of the ready-made templates with a preconfigured form and scope. This is the fastest way to get results.
• Custom mode (Customize) - write your own prompt from scratch, for when a template doesn’t fit your task.

​

Running from a template

Click New Execution. The Start a new run panel opens with a template picker. Open the Template drop-down and pick the one that matches your task - you can add your own, too. For this example we’ll use Cyclic Penetration Testing. Once a template is selected, a short description of it appears along with its input fields. Fill in the required fields:

• domain - the target. Enter it manually (Enter manually) or pick from your existing assets (Choose asset).
• additional_info - optional extra context to steer the run.

Expand Run configuration for additional settings (the same ones available in custom mode below). Then click Start and wait for the results. AutoPT will create tasks - the code it runs. Click a task to see the executed code, its output, and any errors.

​

Custom mode (Customize)

Click Switch to customize on the right. A terminal and a prompt input appear at the bottom. Leave the first selector on Prompt and switch the second one to Pentest. A few more fields appear: Max iterations, RID, and Service.

• Max iterations - the maximum number of times the agent will restart, picking up where it left off, before it stops.
• RID (Runner ID) - the identifier of the code runner that will execute the code for this session.
• Service - which service AutoPT will test.

Write your instruction - for example, ask AutoPT to test a web API for NoSQL injection. After clicking Execute, your prompt appears at the top. The session is created with a Pending Execution status, but execution hasn’t begun yet - you first need to set up MCP-CCE (the runner). See the MCP-CCE guide for details. Click Settings at the bottom to open the run parameters window. This is also where you issue the runner token. In this window you can:

• Issue tokens - issue the runner token. Enter the same ID you set before the prompt and click Issue runner token.
• Set Max iterations and the thinking updates limit for the run.
• Configure the Background scheduler - run asynchronously between manual interventions: scheduling, intervals (limit balancer), and the context refresh interval (5-600 sec).
• Push accepted delta - automatically apply accepted context changes after each iteration.
• Service override - override the AutoPT service (leave empty to use the namespace default).

Once the runner is up, click Run Code to begin the AutoPT execution. During execution, you can watch the progress and AutoPT’s reasoning (Thinking process) right in the IDE. You’ll see buttons to stop or resume the execution. The text field lets you send additional instructions to AutoPT mid-run:

• A plain prompt acts as a small correction.
• /pin <prompt> - pin an instruction so it carries over from one iteration to the next.
• /unpin <ID> - remove a pin from memory. The ID is a sequential number (1, 2, 3…) assigned to pins in order.
• /do <task> - add a task directly to the queue.

How these input channels work, and when to reach for each, is covered in the Prompting guidelines. There are four tabs on the right:

• Assets - all assets, vulnerabilities, and defended attacks.
• Executions - other runs.
• Queue - the queue of tasks AutoPT set for itself (its to-do list). It also contains History - the list of tasks already completed.

• Plugins - extensions for the session. Click Plugins to open the panel:
  • Pins - the pinned notes AutoPT keeps in memory as important context (the same as the /pin command). You can view and remove them here (List Pins, Remove Pin).
  • Report Generator - generate a report for the current execution, not the whole namespace (Generate Report, List Reports, Download Report).
  • Hello World - a small test plugin that confirms the plugin system is working.

To pull context from AutoPT, open the Assets tab on the right and click Changes. The Session changes → scope window opens - the edits collected during this session. They are written to the real scope only once you apply them. Click Apply to scope to accept them, or Revert to discard them.

​

Usual vs Background mode

Every AutoPT run is either Usual or Background, set with the Usual / Background toggle.

• Usual - an interactive session you drive and watch.
• Background - the run keeps going on its own between your interventions, which suits long engagements.

Background runs follow a run policy you set in the Settings window. It has a few parts. Context auto-sync. Pulls the agent’s new findings into the platform on a schedule, so nothing sits unclaimed because someone forgot to sync. You set the interval, and under Advanced you can auto-apply findings straight into the asset graph, push accepted changes back to the agent, and hold a sync while you’re still reviewing pending changes. Pacing. Spreads the run out instead of burning through it. Run the first few iterations back to back as a warm-up, then leave a gap - up to 7 days - between each one after that. Continuous mode. Restarts the run automatically after it ends. A budget or limit stop resumes at the next daily reset; an error stop retries after a shorter delay. A run you stopped by hand is never restarted, and one that finished its work only restarts if you turn on “restart after it finishes on its own.” You can cap the number of retries (0 means unlimited). Termination rules. Let the run stop by itself - after a set number of iterations that error out in a row (always on, a crash-loop guard), or, if you enable it, after several iterations that turn up nothing new. Capacity reserve. Holds background runs back once the namespace has committed a share of its daily token budget (75% by default), so a manual session still has room to run. With continuous mode on, held runs resume at the next daily reset.

​

Step 3: Review results

As testing runs, apply context changes periodically to sync your results. This updates the asset map and populates the vulnerability and defended attacks lists. Findings appear in the Asset map section: For a full vulnerability list, check the Vulnerabilities tab: Tests that didn’t find vulnerabilities are logged in the Defended attacks tab. For example, if AutoPT tested for GraphQL introspection but the server blocked it, that gets logged here.

​

Generating a report (for this session only)

Either way you run it - template or custom - you can generate a report from the results. When the agent finishes, it will let you know and suggest generating a report. To do so, click the Plugins button on the right-hand side. You’ll be greeted with the following window: Click Generate report. From here you can set the report format and language, and give the report a name.

• Available languages: English (en), Russian (ru)
• Available formats: Word document (docx), Markdown (md)

Then click Run. A progress bar will appear showing the generation in real time. Once it’s done, click Download Report, select the report you want, and click Run. A download button will appear at the bottom. That’s your finished OSINT deliverable, ready to hand off or fold into a wider engagement.