Founder from Uzbekistan created a startup that checks company security using AI

While ChatGPT writes texts and generates code, the Uzbek startup Cerberus Tech is teaching artificial intelligence to find vulnerabilities in corporate systems. The company’s founder, Aziz Akhmedkhodjaev, told The Tech how a scientific discovery made at age 17 became the foundation of an AI hacker, why banks are already testing the product, and why the company needed its own programming language to control AI actions.

Aziz Akhmedkhodjaev, city — Tashkent, CEO & Founder Cerberus Tech, CEO & Founder C7 Cybersecurity, LinkedIn

How it all began

We engage in white-hat hacking — a practice where banks, large companies, and other organizations hire hackers themselves to find vulnerabilities in their systems.

In essence, we wanted to create a service that operates on the same principle as ChatGPT, but for cybersecurity. Instead of a query like “write a letter,” the user can say: “Check this website” or “Find vulnerabilities in this application,” and the system will perform the task.

Moreover, it does this quickly and significantly cheaper than traditional testing. The cost of checking one application for us is about eight dollars, and the entire check takes only a few hours.

The idea of an AI hacker is not new in itself. Such a system has been dreamed of for a long time. But the main problem is not creating an artificial intelligence that can hack systems. The key question is whether it can be trusted with access to critical infrastructure. Existing AI systems do not provide such guarantees. If given too broad authority, they may go beyond the scope of the assigned task and cause damage. This is why most companies are not ready to entrust them with real corporate or banking systems.

Our task was to create a safe AI hacker that can be fully controlled. The user sets a specific goal — for example, to check a certain website or application — and the system works exclusively within these boundaries. We mathematically guarantee that it will not perform any actions outside the set task.

For this, we developed our own programming language, specifically designed to manage AI actions. We trained our model on it, so it does not just generate answers, but sequentially writes and executes code until it achieves the set goal, while remaining within the given constraints.

Startup launch

If we talk about the development of the startup, the story began much earlier. It all started when I was 17 years old. At that time, I made a scientific discovery in the field of theoretical computer science, or more precisely, in mathematical theory studying the security of programming languages. I was lucky to do this at a relatively young age, publish the research results, and gain recognition.

At that moment, I thought this discovery was applicable only to programming languages. After that, I continued conducting research for about two more years.

About a year and a half later, I opened a company in Uzbekistan that specialized in penetration testing, security auditing, and white-hat hacking. We helped companies find vulnerabilities in their systems.

When ChatGPT and modern AI models appeared, our team and I realized that my scientific discovery could be applied in a completely different area — using mathematics to make artificial intelligence safe. Essentially, to create a mechanism that would allow controlling AI actions in a way no one had done before.

After that, we spent more than a year and a half on research, creating prototypes, and refining the product. From the outside, it might seem that everything happened quickly, but behind this stood enormous research work. We developed our own programming language to manage the system, trained the models, tested different approaches, and gradually brought the product to the level it is at today.

The team

The team also did not form immediately. We met during our university studies. At that time, there was a cybersecurity club at the university, and in parallel, I organized a free hacking intensive. I wanted not only to prepare a new generation of specialists but also to find strong people with whom I could work further.

About 100 people came to the first cohort. But the training was intensive. Within the first few weeks, a significant portion of participants dropped out, and even more left later. In the end, only a few people completed the program — and they turned out to be the strongest.

We met most of the current team there. They were the best participants of the intensive, and after its completion, we started working together. However, not all employees came from the same university. For example, Abbos Rikhsiev, who is responsible for business development here, graduated from MGIMO. This is quite logical: a person responsible for company development should possess strong business expertise, not just technical knowledge.

The team has always actively participated in cybersecurity competitions. We competed in various tournaments in Uzbekistan and also organized large-scale cybersecurity competitions in the country ourselves.

Target audience

All our first clients came to us through our previous company, C7 Cybersecurity, which has been engaged in information security auditing for many years and remains one of the leading companies in this field in Uzbekistan.

During this time, we worked with a large number of banks and large enterprises. When the new product appeared, we offered to test it with clients we had previously collaborated with. For them, we deployed trial and demo versions so they could evaluate the solution’s capabilities in real-world conditions.

Currently, many banks in Uzbekistan are testing the product. Typically, the pilot period lasts about three months, after which companies decide on full-scale implementation.

We sell the product via license. For corporate clients, the minimum license cost is $60,000 per year. This amount includes not only access to the product but also technical support, maintenance, and other corporate services.

Aside from banks that were previously our clients in the cybersecurity sector, we already have several enterprise clients using the product in production mode.

Incubation programs

If we talk about startup development, one of the important stages was participation in the 500 Global accelerator program. Over three months, the team underwent training, after which they presented at Demo Day to investors. Such programs help startups not only refine their product and business model but also attract funding at a higher company valuation.

In the first stage, the startup developed entirely through its own funds. All income from our cybersecurity company was invested in the development of the new product. A significant part of the budget went toward research, creating a testing laboratory, training models, and conducting experiments. Therefore, the initial development was fully funded by the business, which by that time had already been operating in the information security market for more than three years.

Subsequently, the startup attracted external investments, although we cannot yet disclose the total amount of funding raised.

Challenges

Cybersecurity is one of the most complex and responsible fields because it involves protecting critical infrastructure and people’s data. Almost all spheres of life are managed by software: banking systems, energy, transport, government facilities, medicine, industry, and even defense technologies. All of this works thanks to computer systems, which means they can become targets for cyberattacks.

And this is not a hypothetical threat — such incidents happen regularly. One of the most famous examples is the attack on the American company Colonial Pipeline. Similar attacks also occur in the healthcare sector. Hackers breach hospitals, block access to medical systems, and demand ransoms. In such situations, time literally counts in hours, as the operation of equipment depends on patients’ lives. This is why cybersecurity requires an especially high level of responsibility and reliability.

The greatest difficulty was creating a technology that did not previously exist. Developing a product based on our own scientific research required long-term work: we repeatedly rewrote the architecture, tested the system on real infrastructures, refined algorithms, and conducted extensive research. Creating a solution that is truly new to the market is not an easy task.

Speaking of advice for aspiring entrepreneurs, I would recommend first gaining deep experience in the field where you want to build a business. Most startups created by people without industry expertise do not reach successful outcomes. Without understanding the subject area, it is extremely difficult to create a product that will be truly in demand and able to offer something new to the market.

Therefore, it is better to first accumulate knowledge and practical experience, and only then launch your own project. This significantly increases the chances of success.

At the same time, it is important not to be afraid of risks. As one of our team members added, those who are completely unwilling to take risks ultimately risk the most. The main thing is to take the first step, stay true to your principles, continue moving forward, and believe in what you are doing.

Achievements

One of the main personal achievements was the scientific discovery made at age 17 in the field of theoretical computer science and computation theory. For science, the ability to achieve a new result that did not previously exist is itself a significant achievement, and doing so at such a young age became an important milestone in my professional path.

At 18, I became the youngest participant in the entire history of the Scottish Programming Languages and Verification Summer School PhD school in Scotland. This is not a full PhD program, but an international research school organized by leading universities in Scotland and the UK. It is dedicated to programming language theory — the field I specialize in. Most participants were graduate students and PhD holders.

A separate achievement was the team assembled around the project. It includes specialists with strong academic and competitive experience. For instance, Sarvar Bazarov is a prize-winner of the International Olympiad in Financial Security, held annually in Sochi. Representatives from more than 35 countries participated in the competition, and he represented Uzbekistan for two consecutive years, taking prize places. Imron Mahmudov, in turn, is a hacking champion and winner of the largest specialized tournaments. 

The startup’s main achievement was the development of a system that allows conducting full-scale security testing of real companies and digital products in minimal time, with minimal costs, and minimal risk.

If in ChatGPT you can set the task “Write a letter to a partner,” then on our platform, the user can give the command: “Check my company’s website and find vulnerabilities.” The product is distributed via license, so testing is possible only for own systems. The user uploads a website or application, sets check scenarios, and then the system independently conducts legal security testing. Today, a full check can be launched with literally two clicks — achieving this level of automation was the main focus of our research and development.

Plans

By the end of the year, we plan to scale as much as possible. Figuratively speaking — to “take over” the market. Favorable conditions exist in Uzbekistan for this. We are already working with a large portion of the country’s major banks and companies, and this work continues.

One of our main goals was to attract investment from 500 Global, as it is one of the largest venture funds in the world. They were early investors in companies such as Canva, GitLab, and many other technology leaders. For us, this was an important step, as we initially aimed at entering the international market.

Currently, we have already registered a corporation in the US, and it is through this entity that we will develop international expansion. Our plans include markets in the US, Europe, the UK, and Central Asia.