Runtime API security for REST, WebSocket, gRPC and streaming APIs.

Cyron API Security detects and blocks attacks on REST, WebSocket, gRPC, Server-Sent Events and Socket.IO traffic. It analyses a copy of your traffic, so nothing is added to your request path. Use it as SaaS from $0, or run it on your own servers.

Start free See plans

Out of band

Out of band by design

Cyron analyses a copy of your traffic, so your requests never wait for a verdict. Real-time scoring runs as traffic arrives. Deep analysis follows: rules, threat-intelligence correlation, behavioural intelligence and, for borderline events, the AI analyst. When an attack is confirmed, a signed command tells your agent to block the source.

Protocols

Five API protocols, each read in its own format

Five API protocols: REST and HTTP, WebSocket, gRPC, Server-Sent Events and Socket.IO.

Cyron

REST and HTTP

WebSocket and Socket.IO

gRPC and SSE

One platform. Five API protocols.

REST and HTTP, versions 1.1 and 2

The full request and response: headers, parameters, JSON and XML bodies.

gRPC and Protobuf

Parsed on the wire with no schema needed; schema-aware when you upload a .proto or Cyron discovers one by reflection.

WebSocket

The upgrade handshake, the origin, every frame and its direction, and connection statistics.

Socket.IO

Analysed as a WebSocket transport, with event names.

Server-Sent Events

Analysed by the streaming engine.

AI agent traffic, MCP and A2A

Recognised and labelled for filtering, with API-layer protection for MCP; agent-layer analysis on-premise with Cyron AI Security.

OWASP API Top 10

Dedicated detection for all ten OWASP API Security risks

Each category in the OWASP API Security Top 10 (2023) has its own detection logic in Cyron. This is what each one looks for. Also caught as traffic arrives: ten common attack-scanner fingerprints and headers used to bypass authentication.

API1 Broken object level authorisation

Sequential-ID scanning, bulk enumeration of resources, a success after repeated failures, manipulated identifiers, parameter pollution.

API2 Broken authentication

JWT attacks: alg:none, empty signatures, expired tokens, kid injection, embedded-key injection, weak secrets. Brute force, credential stuffing, password spraying, tokens in URLs, leaked tokens.

API3 Broken object property level authorisation

Excessive or sensitive field exposure, mass assignment, prototype pollution.

API4 Unrestricted resource consumption

Oversized requests, slow responses, deep nesting, pagination abuse, WebSocket floods, gRPC nesting bombs.

API5 Broken function level authorisation

Access to functions you mark as restricted, method override.

API6 Unrestricted access to sensitive business flows

Bot user-agents, checkout and purchase velocity, coupon abuse.

API7 Server-side request forgery

Internal addresses, cloud metadata endpoints for AWS, Google Cloud and Azure, encoded addresses, unusual URL schemes.

API8 Security misconfiguration

Stack-trace leaks, debug mode, version disclosure, directory listing, missing security headers, wildcard CORS with credentials.

API9 Improper inventory management

Deprecated versions, test and staging endpoints exposed, endpoints first seen in the last day.

API10 Unsafe consumption of APIs

Cyron reports injection here: SQL injection in five variants, cross-site scripting, command injection, path traversal, LDAP, XXE, template injection, NoSQL, XPath and Log4Shell.

Streaming and RPC

31 real-time detectors for streaming and RPC APIs

Many security tools stop reading at the handshake. Cyron reads every WebSocket frame, gRPC message and event stream. Deep analysis adds Protobuf field-level injection, gRPC FieldMask evasion, and bulk data leaving a stream. Attacks on these protocols now trigger a block of the source, as HTTP attacks always have.

Injection inside messages (6)

SQL injection, cross-site scripting, command injection, path traversal, Log4Shell and NoSQL injection inside a frame or message.

Cross-site WebSocket hijacking (CSWSH) (2)

Missing origin, mismatched origin.

Floods and denial of service (4)

Message floods, tiny-frame floods, sequence jumps.

Authentication (4)

Credentials over unencrypted WebSocket, missing credentials, gRPC calls with no authentication metadata.

gRPC wire level (6)

Unknown-field injection, nesting bombs, oversized messages, reflection probing.

Protobuf structure (5)

Field-count explosion, abnormal nesting depth, oversized fields.

Header and metadata injection (4)

Injection in upgrade headers and gRPC metadata.

Sensitive data

50 sensitive-data patterns for data leaving in responses

Cyron scans API responses for data that should not leave: six categories, including national identifiers from 11 countries. Card numbers, IBANs, routing numbers and national IDs are validated to keep alerts clean, and encoded data is decoded before matching.

Identity (18)

National IDs from the US, UK, India, Germany, France, Canada, Australia, Spain, Brazil, South Korea and Japan; passports; dates of birth.

Financial (9)

Card numbers, IBAN, SWIFT, routing and account numbers.

Contact (8)

Email, phone, postal address and postcode.

Government and business (6)

Tax and VAT numbers, vehicle identifiers.

Health (5)

Medical record numbers, insurance IDs, NHS numbers.

Network (4)

IP addresses, device identifiers.

Behavioural

Behavioural intelligence: catching attacks made of valid requests

Some attacks contain nothing malicious in any single request. Cyron learns a baseline for each endpoint and watches whole sessions, with thirteen session rules: resource enumeration, sequential probing, parameter pollution, authentication probing, credential stuffing, excessive data exposure, rate abuse, mass assignment, WebSocket subscription abuse, gRPC reflection reconnaissance, cross-protocol escalation, gRPC FieldMask evasion and WebSocket replay across sessions. Essential plan and above.

System 2 Thinking

System 2 Thinking: a reasoned second opinion on borderline events

When an event is neither clearly safe nor clearly hostile, Cyron's AI analyst investigates: the endpoint's normal behaviour, the caller's history, related incidents and threat intelligence. It returns a verdict with a recommended action and numbered reasoning, attached to the incident and sent to your SIEM. Secrets are removed before analysis, no public AI service is used, and real-time blocking never waits for it.

A verdict you can read.

Safe, suspicious, malicious, confirmed threat, false positive or needs human review, with a recommended action and the full chain of reasoning. It is attached to the incident and sent to your SIEM.

Never in the way.

The analyst works after the fact. Real-time detection and blocking do not wait for it.

No event unjudged.

A rules-based fallback decides whenever the analyst is unavailable or the monthly allowance is used up.

Private by design.

Authorisation headers, cookies, tokens, keys, passwords and card numbers are removed before analysis. No public AI service is used.

Capacity.

3,000 analyses a month on Standard and 8,000 on Premium. On-Premise has no allowance: the analyst runs on your hardware.

Threat Intelligence

Threat intelligence that needs agreement before it accuses

Seven supported threat-intelligence feeds, kept on the platform so lookups stay fast and private. An address is marked malicious only when sources agree, and scores fade as evidence ages. Anonymiser traffic on login endpoints is flagged. Every confirmed attack across the Cyron network strengthens protection for every customer. On-premise sites import threat intelligence offline.

iris

Blocking at the kernel, under your control

On a confirmed attack, Cyron sends a cryptographically signed command to your agent. iris drops the attacker's packets at the kernel; the proxy and web-server agents answer with HTTP 403. Blocks expire on their own, and you can exempt any endpoint or mark any incident as a false positive in one click.

Network Interface

iris (eBPF)

Block

Pass

Application

Less noise.

Exempt an endpoint and it is still analysed but raises no incident or block. When one API keeps raising incidents, Cyron pauses further alerts for it until you resume analysis with one click. Mark any incident as a false positive.

Discovery

An inventory of every API, built from traffic

Cyron discovers APIs passively on every protocol. Paths with identifiers collapse into one template, so the inventory stays clean. Each API carries a risk score that falls as clean traffic returns. You can also register APIs by hand, and keep gRPC schemas with their versions.

Built for the person working the incident

Live traffic filterable by protocol, incidents with a breakdown of what drove the score, per-connection views for WebSocket and streams, a health page for every capture source, and signed OCSF-aligned events for any SIEM that accepts a webhook.

Capture

Ways to send traffic to Cyron

iris copies REST, WebSocket, gRPC, Socket.IO and Server-Sent Events traffic, and MCP and A2A traffic. No kernel agent on that host? Cyron also takes traffic from a Linux proxy agent, a web-server module, a traffic mirror, or imported HAR and log files.

iris eBPF kernel agent

Blocks at the kernel.

Linux proxy agent

Blocks with HTTP 403.

Web-server module

Blocks with HTTP 403.

Traffic mirror

A copy of your traffic, from your network.

HAR and log import

Imported files.

Application middleware

From inside your application.

Deployment

SaaS or On-Premise: one detection pipeline

Cyron SaaS is hosted in Germany and starts at $0. Cyron On-Premise runs the same pipeline on your servers, with the AI analyst running locally and Cyron AI Security included for your agent traffic.

Choose your plan

Pick the detection depth that matches your team's needs. Every plan includes multi-protocol coverage across REST, WebSocket, gRPC, Server-Sent Events and Socket.IO.