Cyron March 2026 Release: Streaming and RPC Protection
Cyron's March 2026 release brought streaming and RPC protection to the platform. Read what shipped, then follow every later release in the Cyron changelog.
The March 2026 release took Cyron beyond REST. It brought streaming and RPC protection, iris, the eBPF kernel agent, behavioural intelligence and a rebuilt threat-intelligence engine. This page is the dated record of what shipped.
What changed in the Cyron March 2026 release?
Cyron began reading WebSocket and gRPC traffic natively, alongside REST. iris, the eBPF kernel agent, arrived to capture traffic at the kernel and drop an attacker’s packets there. The release also brought the full detection pipeline to Cyron On-Premise, behavioural intelligence, seven supported threat-intelligence feeds and alert suppression when the AI analyst rules an event a false positive.
Streaming and RPC protection
Many security tools stop reading at the handshake. Cyron reads every WebSocket frame, gRPC message and event stream. Real-time APIs carry chat, trading, live tracking and service-to-service calls, and attacks inside them look nothing like a malformed HTTP request.
The release extended Cyron’s detection pipeline from REST to WebSocket and gRPC. Each protocol is read in its own format, and every stage works on each one: real-time scoring, deeper analysis of borderline events, behavioural intelligence, threat-intelligence enrichment, System 2 Thinking, incident creation and SIEM events.
gRPC traffic is parsed on the wire, with no schema needed. Teams that use gRPC can also upload .proto files through the dashboard for schema-aware analysis.
iris: the eBPF kernel agent
iris is Cyron’s Linux agent, built on eBPF. One compact binary replaced the earlier Linux agents. It captures WebSocket, gRPC and REST traffic over HTTP/1.1 and HTTP/2 at the kernel, with no proxy in the path and no code changes.
On a confirmed attack, Cyron sends a cryptographically signed block command, and iris drops the attacker’s packets at the kernel. Block rules persist across agent restarts.
Cyron On-Premise
Cyron On-Premise brings the complete detection pipeline to your own infrastructure. It installs from one offline script and updates offline. The AI analyst runs on your hardware, detection models are encrypted with a key unique to each customer, and traffic and findings stay in your network. On-premise sites import threat intelligence offline.
Cyron On-Premise is priced by quote.
Behavioural intelligence
Some attacks contain nothing malicious in any single request: BOLA enumeration, credential stuffing, data scraping, webhook abuse. The behavioural intelligence engine catches attacks made of valid requests. It learns a baseline for each endpoint and watches whole sessions, and it raises an incident only when the signals agree.
Today it runs per-endpoint baselines and 13 session-level rules, on Essential and above.
Threat intelligence
Seven supported threat-intelligence feeds replaced the earlier single source. They are kept on the platform, so lookups stay fast and private. An address is marked malicious only when sources agree, and scores fade as evidence ages.
Additional improvements
- Detection of sensitive data leaving in API responses (OWASP API3:2023)
- Endpoint exemptions: an exempted endpoint is still analysed but raises no incident or block
- SaaS hosted in Germany
- Alert suppression when the AI analyst rules an event a false positive
Since March
Cyron has shipped a release roughly every two months since November 2025. Today Cyron API Security reads five API protocols: REST and HTTP, WebSocket, gRPC, Server-Sent Events and Socket.IO, with 31 real-time detectors for streaming and RPC APIs.
Since the September 2026 release, attacks on WebSocket, gRPC, Server-Sent Events and Socket.IO also trigger a block of the source, as HTTP attacks always have.
Every release, newest first, is in the Cyron changelog.
Get started
Try Cyron API Security on the free plan: no card, no time limit, and no code changes. The product guide walks through setup.
Updated 1 October 2026: new title, a summary of the release, current product names and wording, a link to the Cyron changelog and a pointer to the September 2026 release.