The Problem
Unmanaged IoT and OT devices are invisible to agent-based tooling — no agent, no entry in the CMDB, no owner. They sit at the network edge as soft targets: cameras, controllers, printers, lab gear. You can't protect what nothing in your stack admits exists.
What It Does
Cerberus is a four-stage agent squad — Discovery → Expansion → Cross-Reference → QA — that fuses web-UI and banner text, UPnP/SSDP, mDNS, OT/ICS protocol, and OUI vendor signals into a confidence-scored inventory of unmanaged devices. Each find is tagged IoT:<name>, and the squad learns new detections as it goes.
Key Capabilities
- Confidence-scored fusion engine — web-UI/banner text, UPnP/SSDP, mDNS, OT/ICS protocol, and OUI vendor signals combine into one High/Medium/Low verdict per device.
- OT/ICS protocol class — industrial protocols are recognized as their own device class, not lumped in as "unknown."
- OUI vendor and prefix mapping — MAC-derived vendor evidence maps to device class, working even when a device answers nothing else.
- Managed-device down-weighting — hosts your tooling already manages are down-weighted, keeping the list focused on the truly unmanaged edge.
- Per-device signal breakdown — every verdict shows exactly which signals drove it, so teams can verify before they isolate.
- Gated "IoT:<name>" tags — discovered devices become human-approved, routable inventory.
How It Works
Runs against the local navi.db built from your Tenable data — the vulns and assets tables plus the cert-derived device cache from Certania. All writes are proposed, human-approved, and logged.
Who It's For
OT and IoT security teams who need an inventory they can defend; network teams hunting the unmanaged edge; vuln management extending coverage beyond agents.
Proof Points
Runs its four-stage sweep across a 268-asset reference environment — including IoT/OT gear — scoring each candidate device High, Medium, or Low confidence with the signals shown. Detection quality depends on what scans observe at the edge; blind segments are called out, not hidden.
Works Better With
Feeds Anubis (lab/OT devices re-rated to true criticality) and Fenrir (weak-auth edge devices become attack-path entry points). Consumes Certania's cert-derived device cache.