Cyber attacks, killed in under 100ms.
KYSIRA: From the Greek Kyrios (authority over) and Thyra (door/gate) — "Guardian of the threshold"
Most companies find out they've been breached 277 days after the fact. Kysira stops attacks in 40 milliseconds — before they reach your app, your users, or the news. No code changes. No new agents. One container.
The same attacks have topped the charts for 20 years. Most companies still find out months too late.
Injection, broken access control, cross-site scripting, server-side request forgery. The same handful of attack classes account for the majority of breaches every year. Detection today still relies on humans in a security operations center reading dashboards. By the time someone notices, your and your customers' data is already sold to a bad actor.
The hard part to admit: most organizations are still defending at human speed, while attackers have already moved to machine speed.
Status quo
Mean time to acknowledge a SOC alert. Actual response takes hours or days.
Kysira
Detect, decide, and reset the TCP connection. The attacker sees their terminal die mid-payload.
One container. Zero code changes. Attacks stopped before your app sees them.
Drop Kysira in front of your application and you're protected. Every request gets scored by an AI classifier in under 40ms. Attacks are cut off at the connection — your application never runs a line of code for them.
Drop in as a proxy
One container in front of your app. No SDK, no code changes, no agent on your database. Works with anything that speaks HTTP.
Classify in 40 ms
A purpose-built language model (not a regex set) reads the full request and returns a confidence score plus a human-readable reason.
Reset the connection
Above threshold, the TCP connection is severed. The attacker's tooling reports "connection reset by peer." Your application never saw the request.
live.kysira.ai — real requests, scored and killed in real time
Interactive demo
A public, always-on sandbox running a deliberately vulnerable web app behind a real Kysira proxy. Every request that hits it is scored in front of you, with the model’s confidence and the reason it made the call.
- Per-request score, verdict, and latency
- Human-readable reason for every decision
- Throw your own payload at it — no account required
app.kysira.ai/register — company and admin account in one step
Your account and deployments
Create a company account in one step, invite your team, and issue license keys for each proxy you deploy. Everything a running install needs — keys, image access, certificates — is managed from the same console.
- Company account with role-based team access
- License keys per environment or per cluster
- Container registry access and agent certificates
- Ingest logs so you can confirm telemetry is flowing
docs.kysira.ai — public product documentation
Documentation that gets you running
Full public docs covering quickstart, licensing, deployment models, detection architecture, observability, the API reference, and troubleshooting. No sales call required to read how it works.
- Quickstart for proxy, sidecar, and gRPC filter deployments
- Detection architecture and how scoring is done
- API reference and observability/metrics wiring
Your WAF matches patterns. We understand attacks.
Traditional firewalls block what they've seen before. Change the encoding, rephrase the payload, and they wave it through. Kysira uses an AI classifier that understands the intent of a request — not just its shape.
Check our work before you trust it with your traffic.
You should not have to take a security vendor's word for anything. Everything below is public, no sales call required.
Public documentation
Quickstart, deployment models, detection architecture, observability, and a full API reference — readable before you ever sign up.
docs.kysira.ai →A demo instance you can attack
A real proxy in front of a deliberately vulnerable app, open to the public. Fire real payloads at it and watch the verdicts land.
live.kysira.ai →Self-service sign-up
Create an account, get a license key, and run the container. No procurement gate between you and a shadow-mode deployment.
app.kysira.ai →A named team and a real company
Kysira Corporation, registered in Delaware, with a founder you can look up and a support address a human reads.
Get in touch →A public release history
Every proxy, inference, and dashboard release, versioned and dated, with a short description of what shipped.
Release notes →Common questions
The things engineering teams ask us before they deploy. If yours is not here, the docs go deeper — or just ask us directly.
What's the false positive story?
Kysira ships in shadow mode by default, logging every decision and adding headers while requests still pass through. Operators run it for a week, review the would-have-killed events, then flip a single toggle to active. False positives become observable before they become incidents.
What attack classes does it cover?
Kysira protects against all common OWASP attack classes: SQL injection, cross-site scripting, command injection, SSRF, prompt injection, credential stuffing, and more. Each is defended by a tailored model purpose-built for that threat. Our system continuously monitors traffic in real time, so even novel attacks that have never been seen before are caught and stopped fast.
Why is this different from a WAF like Cloudflare or AWS WAF?
WAFs are rule engines. They match patterns. Kysira is a language model that understands the structure of an attack regardless of obfuscation, encoding, or novel phrasing. It also gives you a reason for every decision, which a regex can't.
How does the latency stay under 100ms with a language model?
We use compact, purpose-built classifiers (not a general-purpose LLM), quantized and baked into the container image so there's no cold start. They run on CPU; no GPU required. The proxy and inference sidecar communicate over loopback, adding under a millisecond. Total budget end-to-end: well under 100ms on commodity hardware.
What about encrypted traffic?
Kysira terminates TLS at the proxy (or runs behind your existing TLS terminator like Caddy or Cloudflare). It only inspects what your application would have seen anyway. No novel decryption required.
What happens if Kysira goes down?
The proxy is fail-open. If the classifier is unreachable or exceeds its latency budget, the request passes through unmodified. A Kysira outage degrades your protection; it never takes your application offline.
See an attack die in 40 milliseconds.
The fastest way to understand Kysira is to watch it work. No account, no sales call — the live monitor is open to anyone.