Questions, answered straight.
What we get asked before a proxy goes in front of production traffic. If yours is not here, the docs go deeper, or just ask us.
What's the false positive story?
Kysira ships in shadow mode by default, logging every decision and adding headers while requests still pass through. Operators run it for a week, review the would-have-killed events, then flip a single toggle to active. False positives become observable before they become incidents.
What attack classes does it cover?
Kysira covers the common OWASP attack classes: SQL injection, cross-site scripting, command injection, SSRF, prompt injection, credential stuffing, and more, each with a classifier built for that threat. Because those classifiers read what a request is trying to do instead of matching known strings, new variants get caught too, not only the ones already on a signature list.
Why is this different from a WAF like Cloudflare or AWS WAF?
WAFs like those are rule engines. They match patterns. Kysira's classifiers read the structure of an attack, so obfuscation, re-encoding, or new phrasing doesn't slip past them the way it slips past a rule. Every decision also comes with a reason you can read, which a regex can't give you.
How does the latency stay under 100ms with a model in the request path?
We use compact, purpose-built classifiers (not a general-purpose LLM), quantized and baked into the container image so there's no cold start. They run on CPU; no GPU required. The proxy and inference sidecar communicate over loopback, adding under a millisecond. Total budget end-to-end: well under 100ms on commodity hardware.
What about encrypted traffic?
Kysira terminates TLS at the proxy (or runs behind your existing TLS terminator like Caddy or Cloudflare). It only inspects what your application would have seen anyway. No novel decryption required.
What happens if Kysira goes down?
The proxy is fail-open. If the classifier is unreachable or exceeds its latency budget, the request passes through unmodified. A Kysira outage degrades your protection; it never takes your application offline.
How do I deploy it?
Three ways: as a standalone reverse proxy in front of your app, as a sidecar alongside it, or as an Envoy external-processing filter inside an existing service mesh. All three are one container and no application code changes. The quickstart in the docs covers each.
What does Kysira cost?
One plan, flat rate: $3,600 per month, or $36,000 paid annually (two months free). Unlimited request volume, every attack class, and every deployment model are included. We don't meter requests, so being attacked more doesn't cost you more.
Can I try it before I pay?
Yes. Create an account, get a license key, and run the container in shadow mode, where it scores and logs every request without blocking anything. You can review exactly what Kysira would have killed on your own traffic before any money changes hands.
Does my request data leave my infrastructure?
Only if you want it to. If you run Kysira entirely inside your own infrastructure without connecting to the Kysira control plane, request data stays in your environment and is never transmitted to us. Connecting the control plane sends security telemetry (request metadata, scores, decisions, and latencies) so it can be displayed in your dashboard.
How do I see it work right now?
Hit the live monitor at live.kysira.ai. It's a deliberately vulnerable web app sitting behind a real Kysira proxy, open for anyone to try. It is not a customer environment. Fire an attack payload and watch it get scored and killed in real time. Customers get their own dashboard, scoped to their own traffic, after signing up.
Do I have to talk to sales?
No. Sign-up is self-service: create a company account, get a license key, pull the image, and deploy. There's no procurement gate between you and a shadow-mode deployment. Talk to us when you have a question, not because a form made you.
See an attack die in under 100 milliseconds.
The fastest way to understand Kysira is to watch it work. No account, no sales call: the live monitor is open to anyone.