The whole product, on one page.

Kysira is a reverse proxy plus a control plane. The proxy scores and kills attacks on the request hot path. The control plane is where you watch it happen, tune it, and manage deployments across your fleet.

<strong>Interactive</strong> demo

live.kysira.ai — real requests, scored and killed in real time

Interactive demo

A public, always-on sandbox running a deliberately vulnerable web app behind a real Kysira proxy. Every request that hits it is scored in front of you, with the model’s confidence and the reason it made the call.

  • Per-request score, verdict, and latency
  • Human-readable reason for every decision
  • Throw your own payload at it — no account required
Try it live →
Your account and <strong>deployments</strong>

app.kysira.ai/register — company and admin account in one step

Your account and deployments

Create a company account in one step, invite your team, and issue license keys for each proxy you deploy. Everything a running install needs — keys, image access, certificates — is managed from the same console.

  • Company account with role-based team access
  • License keys per environment or per cluster
  • Container registry access and agent certificates
  • Ingest logs so you can confirm telemetry is flowing
Create an account →
Documentation that gets you <strong>running</strong>

docs.kysira.ai — public product documentation

Documentation that gets you running

Full public docs covering quickstart, licensing, deployment models, detection architecture, observability, the API reference, and troubleshooting. No sales call required to read how it works.

  • Quickstart for proxy, sidecar, and gRPC filter deployments
  • Detection architecture and how scoring is done
  • API reference and observability/metrics wiring
Read the docs →

Detection that understands the payload

A purpose-built classifier reads the full request and returns a score plus a plain-language reason — not a pattern match.

Full OWASP Top 10 coverage

SQL injection, XSS, command injection, SSRF, path traversal, prompt injection, credential stuffing. One architecture, a tailored model per threat class.

Sub-100ms end to end

Compact purpose-built classifiers baked into the image. No cold start, no GPU, CPU-only inference over loopback.

Explainable decisions

Every verdict comes with a score and a plain-language reason, logged and surfaced in the dashboard. Regex engines can't tell you why.

Understands intent, not shape

A language model reads the full request, so re-encoding or rephrasing a payload doesn't get it past the gate the way it slips past a rule engine.

Deployment that can't take you down

One container, three topologies, shadow mode by default, and fail-open when anything goes wrong.

Shadow mode by default

New deployments score and log every request without blocking anything. Run shadow for as long as you want, review what would have been killed, then flip one toggle to enforce.

Fail-open architecture

If Kysira is unreachable or times out, the request passes through unmodified. A Kysira outage never becomes an application outage.

Three deployment models

Run it as a standalone reverse proxy, as a sidecar next to your app, or as an Envoy external-processing filter in an existing service mesh.

Zero code changes

One container in front of your app. No SDK, no agent on your database, no rewrite. Works with anything that speaks HTTP.

Operations for a real fleet

Keys, roles, telemetry, and a live view of every verdict across every environment you run.

Live control plane

Watch requests get scored in real time, with per-request verdicts, confidence, latency, and the detector that fired.

License keys per environment

Issue a key per environment or per cluster, manage container registry access and agent certificates, and confirm telemetry is flowing from the same console.

Role-based team access

Create a company account in one step and invite your team, with roles scoped to what each person needs.

Observability wiring included

Metrics and structured decision logs you can ship to your existing stack, plus a documented API reference for everything the console does.
Get started

Running in shadow mode in about ten minutes.

No sales call, no procurement cycle. Create an account, pull the image, point it at your app.

Step one

Create your account

Company and admin user in a single form. You get a license key immediately.

Step two

Run the container

One container in front of your app. No SDK, no code changes.

docker run -d \
  -e KYSIRA_LICENSE_KEY=... \
  -e KYSIRA_UPSTREAM=http://app:8080 \
  -p 8443:8443 \
  kysira/proxy:latest
Step three

Review, then enforce

Watch the shadow-mode decisions in your dashboard. When the numbers look right, turn on blocking.

See an attack die in 40 milliseconds.

The fastest way to understand Kysira is to watch it work. No account, no sales call — the live monitor is open to anyone.

Open the live monitor →Talk to the team