Questions, answered straight.
What we get asked before a proxy goes in front of production traffic. If yours is not here, the docs go deeper — or just ask us.
What's the false positive story?
Kysira ships in shadow mode by default, logging every decision and adding headers while requests still pass through. Operators run it for a week, review the would-have-killed events, then flip a single toggle to active. False positives become observable before they become incidents.
What attack classes does it cover?
Kysira protects against all common OWASP attack classes: SQL injection, cross-site scripting, command injection, SSRF, prompt injection, credential stuffing, and more. Each is defended by a tailored model purpose-built for that threat. Our system continuously monitors traffic in real time, so even novel attacks that have never been seen before are caught and stopped fast.
Why is this different from a WAF like Cloudflare or AWS WAF?
WAFs are rule engines. They match patterns. Kysira is a language model that understands the structure of an attack regardless of obfuscation, encoding, or novel phrasing. It also gives you a reason for every decision, which a regex can't.
How does the latency stay under 100ms with a language model?
We use compact, purpose-built classifiers (not a general-purpose LLM), quantized and baked into the container image so there's no cold start. They run on CPU; no GPU required. The proxy and inference sidecar communicate over loopback, adding under a millisecond. Total budget end-to-end: well under 100ms on commodity hardware.
What about encrypted traffic?
Kysira terminates TLS at the proxy (or runs behind your existing TLS terminator like Caddy or Cloudflare). It only inspects what your application would have seen anyway. No novel decryption required.
What happens if Kysira goes down?
The proxy is fail-open. If the classifier is unreachable or exceeds its latency budget, the request passes through unmodified. A Kysira outage degrades your protection; it never takes your application offline.
How do I deploy it?
Three ways: as a standalone reverse proxy in front of your app, as a sidecar alongside it, or as an Envoy external-processing filter inside an existing service mesh. All three are one container and no application code changes. The quickstart in the docs covers each.
What does Kysira cost?
One plan, flat rate: $3,600 per month, or $36,000 paid annually — two months free. Unlimited request volume, every attack class, and every deployment model are included. We don't meter requests, so being attacked more doesn't cost you more.
Can I try it before I pay?
Yes. Create an account, get a license key, and run the container in shadow mode — scoring and logging every request without blocking anything. You can review exactly what Kysira would have killed on your own traffic before any money changes hands.
Does my request data leave my infrastructure?
Only if you want it to. If you run Kysira entirely inside your own infrastructure without connecting to the Kysira control plane, request data stays in your environment and is never transmitted to us. Connecting the control plane sends security telemetry — request metadata, scores, decisions, and latencies — so it can be displayed in your dashboard.
How do I see it work right now?
Hit the live monitor at live.kysira.ai. It's a deliberately vulnerable web app sitting behind a real Kysira proxy, running for anyone to try — not a customer environment. Fire an attack payload and watch it get scored and killed in real time. Customers get their own dashboard, scoped to their own traffic, after signing up.
Do I have to talk to sales?
No. Sign-up is self-service: create a company account, get a license key, pull the image, and deploy. There's no procurement gate between you and a shadow-mode deployment. Talk to us when you have a question, not because a form made you.
See an attack die in 40 milliseconds.
The fastest way to understand Kysira is to watch it work. No account, no sales call — the live monitor is open to anyone.