One plan. Flat rate. No metering.

Everything Kysira does, for every request you serve. Start in shadow mode for free — no card, no procurement cycle.

Bill monthly

Bill annually — 2 months free

Unlimited requests scored — no per-request metering
Full OWASP coverage: SQLi, XSS, command injection, SSRF, path traversal, prompt injection, credential stuffing
All three deployment models: reverse proxy, sidecar, or Envoy ext_proc filter
Shadow mode and fail-open architecture by default
Control plane with per-request verdicts, scores, and reasons
License keys per environment or per cluster
Role-based team access, registry access, and agent certificates
Support from the engineers who build the proxy

Flat rate. No metering.

$3,600 per month, or $36,000 paid annually — two months free. Every attack class, every deployment model, and unlimited request volume are in the plan. We don't charge you more for being attacked more.

Start in shadow mode. Score and log every request without blocking anything, for as long as you want, before you enforce.
No procurement gate. Create an account, get a license key, run the container. Talk to us when you're ready to buy, not before.
Self-hosted stays self-hosted. Run entirely inside your own infrastructure and request data never leaves your environment.

Talk to the team Read the docs

What you get out of the box

There is no feature gate and no add-on tier. Every deployment model, every attack class, and the full control plane ship with the product.

Shadow mode by default

New deployments score and log every request without blocking anything. Run shadow for as long as you want, review what would have been killed, then flip one toggle to enforce.

Fail-open architecture

If Kysira is unreachable or times out, the request passes through unmodified. A Kysira outage never becomes an application outage.

Three deployment models

Run it as a standalone reverse proxy, as a sidecar next to your app, or as an Envoy external-processing filter in an existing service mesh.

Zero code changes

One container in front of your app. No SDK, no agent on your database, no rewrite. Works with anything that speaks HTTP.

Full OWASP Top 10 coverage

SQL injection, XSS, command injection, SSRF, path traversal, prompt injection, credential stuffing. One architecture, a tailored model per threat class.

Sub-100ms end to end

Compact purpose-built classifiers baked into the image. No cold start, no GPU, CPU-only inference over loopback.

Explainable decisions

Every verdict comes with a score and a plain-language reason, logged and surfaced in the dashboard. Regex engines can't tell you why.

Understands intent, not shape

A language model reads the full request, so re-encoding or rephrasing a payload doesn't get it past the gate the way it slips past a rule engine.

Questions about the bill

Flat rate, no metering, no procurement gate. Here is what that means in practice.

What does Kysira cost?

One plan, flat rate: $3,600 per month, or $36,000 paid annually — two months free. Unlimited request volume, every attack class, and every deployment model are included. We don't meter requests, so being attacked more doesn't cost you more.

Can I try it before I pay?

Yes. Create an account, get a license key, and run the container in shadow mode — scoring and logging every request without blocking anything. You can review exactly what Kysira would have killed on your own traffic before any money changes hands.

Does my request data leave my infrastructure?

Only if you want it to. If you run Kysira entirely inside your own infrastructure without connecting to the Kysira control plane, request data stays in your environment and is never transmitted to us. Connecting the control plane sends security telemetry — request metadata, scores, decisions, and latencies — so it can be displayed in your dashboard.

See an attack die in 40 milliseconds.

The fastest way to understand Kysira is to watch it work. No account, no sales call — the live monitor is open to anyone.

Open the live monitor →Talk to the team