Your service, attacked continuously.
Syrah's harness goes after what you run the way an intruder would: continuous black-box testing driven by agentic method — real discovery, real exploitation attempts, and a report that states what was covered, including when nothing was found.
No password. First sign-in creates your account.
How it works
Four steps, no sales call.
Sign in
Email only. A single-use link, no password to lose.
Prove the domain
One TXT record at _syrah-challenge. Re-checked daily, and it lapses if you remove it.
Request a test
You confirm you are authorized; we record exactly what that covered.
Read the report
A PDF with findings, or a documented clean. Same document either way.
What a free engagement covers
Catalogue free-1
- The Syrah harness — our agentic attack engine, running the catalogue below against your domain and following what it finds
- Reconnaissance: 4 checks
- Transport: 4 checks
- Web application: 8 checks
- Exposure: 4 checks
- DNS and email: 3 checks
- Cloud configuration: 2 checks
- Known vulnerabilities: 1 checks
What it will not touch
A wildcard is not a licence to attack everything pointing at your name. Every host is classified before anything runs.
- Hostnames on third-party platforms — Shopify, Statuspage, GitHub Pages, Vercel
- Anything resolving to private, loopback or reserved address space
- Hostnames that do not resolve
- Denial of service, persistence, social engineering, physical access
Excluded hosts are listed in the report with the reason, so you know what a clean result did and did not cover.
A clean report is still a report
Every engagement states what was tested, what was deliberately not tested, and why.
What you get back
- Severity, evidence and reproduction for each finding
- A suggested fix you can hand to an engineer
- The full host list, including what was excluded and why
- The testing window and the catalogue version
- Stated limits — so you know what it does not prove
- A report hash, so a copy is traceable to a version
Data handling
What happens to what we see during a test.
Zero data retention
freeFree testing runs against model providers under zero-retention terms. Prompts, tool output and results are not stored by the provider and are not used for training. Nothing from your engagement becomes training data anywhere.
EU deployment
ProPro engagements run on models deployed in our own infrastructure inside the EU. Your findings and evidence do not leave the region, and each engagement is signed off by an engineer.
Free now. Pro when you need depth.
The free tier is real testing with a real report. Pro adds cadence, scope, mobile and hardware.
Free
availableLimited seats, granted as capacity allows.
- One engagement per calendar month
- Your verified domain and what actually belongs to it
- The full free technique catalogue (free-1)
- The Syrah harness running against your domain
- Agent-generated PDF report — no human review
- Zero data retention at the model provider
Pro
coming soonFor teams that need depth, cadence and proof.
- Weekly runs, or daily — every black-box test in the catalogue
- Scope you define, not just the apex
- Chained exploitation, business logic, authenticated testing
- Android and iOS applications
- Hardware, sent to us
- Engineer-reviewed, EU-hosted models in our infrastructure
- Findings tracking and retests
Talk to us
Pro, hardware, or anything the free program does not cover.
Include the domain, the platforms, and any timeline. For hardware, tell us what the device is before sending anything.
Encrypted mail is welcome, and preferred when it is possible for you.
BE8B 1754 C383 540D D9E8
5ED8 4017 74F3 AA5D A9E4
rsa4096 · Syrah sec <security@syrah.dev>
expires 2040-10-17
Verify the fingerprint before you encrypt. If it does not match, do not send.
Find out what your service is telling the internet
Free, monthly, and the report is yours either way.
Register