Security engineering · Since 2016

A senior security team, without hiring one

We implement DevSecOps, application security, Zero Trust and supply-chain security with products we build and run ourselves.

See how we work →

Free 30-minute consultation · Google Meet

cyphlon / in production Built in-house
Published research Backbone or Backbone-Architecture? A Controlled Study of LLM Agents on Web Penetration-Testing CTFs 2,700+ audited runs. The same model went from 0 to 49 solves by changing only the scaffold.
Team certifications CISSP CISM OSCP CCSP

Solutions

Pick an engagement

Each one is scoped on a call and delivered by our engineers, using the products below.

Compliance Pentest

A scoped penetration test of your web apps, APIs, cloud or network, with a report written for auditors and enterprise buyers.

Learn more →

Recurring & Continuous Pentest

Pentesting on the cadence you ship at: recurring engagements, such as quarterly, or continuous testing on a schedule you set.

Learn more →

Managed AppSec & Detection

We run application security for you: detection across code, dependencies, packages and APIs, triaged by our engineers, with fixes your team approves.

Learn more →

Agentic AI Security

Assess, test and engineer controls for the AI agents, MCP servers and LLM features you run: what they can reach, under whose authority, what needs approval, and how every action is logged.

Learn more →

Security Engineering Projects

Fixed-scope projects where we build the controls with your team and hand them over: pipelines, access, supply chain and cloud.

Learn more →

Fractional CISO

Security leadership without a full-time hire.

Learn more →
Compare all engagements →

Products

Our Products

Security platforms we build and run ourselves, plus open-source tools and research we share with everyone.

Open core Self sign-up

Chainsaw

Block malicious packages before they download.

  • Stops the attacks behind the headlines
  • 25 signals beyond CVEs
  • Works offline
Learn more →
Closed source Self sign-up

DSO

Scheduled code scans, AI pentests, and fixes you approve.

  • SAST
  • SCA with reachability
  • IaC scanning
Learn more →
Closed source Self sign-up

Acksess

Replace the VPN with access that checks every device.

  • Device posture checks
  • Rules you can test
  • Just-in-time access
Learn more →

Free tools and research

Open source

X-Security

One API security policy, compiled to every WAF and gateway.

Learn more →
Open source

OpsMaxx

Every server you look after, in one window.

Learn more →
Open source

LVCScan

Check Laravel applications for known vulnerabilities.

Learn more →

Backbone or Backbone-Architecture? A Controlled Study of LLM Agents on Web Penetration-Testing CTFs

The model is not the agent.

Learn more →
Explore all products →

Why us

Why Cyphlon?

We build what we deploy

The platforms in your engagement are products we build and run ourselves, so the engineers on your project know them from the inside.

Research, published and reproducible

We publish what we learn. Our study of LLM agents on web pentesting CTFs covers 2,700+ audited runs, and the paper and code are open.

People approve, AI assists

Senior engineers lead every engagement, and AI tools assist them. In DSO a person approves every AI verdict and fix. In OpsMaxx, AI agents never receive credentials, and every tool is allow, ask or deny with an audit log.

Senior, certified, regulated-industry advice

Our team holds CISSP, CISM, OSCP and CCSP certifications, and our advisory board brings practitioners from banking, healthcare and govtech.

How engagements grow

Start with a test. Grow from there.

Start where you are. Each step builds on the one before, and you can stop at any of them.

  1. 01 TEST

    A scoped pentest or assessment, reported for auditors and enterprise buyers.

  2. 02 KEEP TESTING

    Recurring or continuous testing, and detection that keeps pace with what your team ships.

  3. 03 ENGINEER

    Build the controls your engineers will run: pipelines, access, supply chain and AI agents.

  4. 04 LEAD

    Security leadership for audits, regulators and enterprise buyers, without a full-time hire.

All services

Need something specific?

Every engagement is made of individual services. Browse them by category and book the one you need on its own.

“Ship Secure Software, Not Security Debt”

Application Penetration Testing

Application Penetration Testing

Manual testing of your web apps, mobile apps and APIs, with a proof of concept and fix for every finding.

Book your free consultation →

Secure Code Review

Secure Code Review

Line-by-line review of your source code for exploitable flaws, with fixes your developers can apply.

Book your free consultation →

Supply Chain Security

Supply Chain Security

Find and control risky dependencies, packages and third-party integrations, from install to build.

Book your free consultation →

DevSecOps

DevSecOps

Security controls built into your pipelines, from pull request to deployment.

Book your free consultation →

Managed AppSec & Detection

Managed AppSec & Detection

Continuous detection for code, dependencies, pipelines and APIs, triaged by our engineers.

Book your free consultation →

Secure SDLC Implementation

Secure SDLC Implementation

Security requirements, threat modelling and checks built into each stage of how you ship.

Book your free consultation →

Smart Contract Auditing

Smart Contract Auditing

Manual and tool-assisted review of smart contracts for exploitable logic and access-control flaws.

Book your free consultation →

DApp Pentesting

DApp Pentesting

Attack testing of decentralised apps: contracts, wallets, front ends and the APIs between them.

Book your free consultation →

View All Services →

Book a call

Book a 30-minute call

Pick a time that suits you. We'll talk through what you're building and where your security stands, then suggest where to start.

Logo

Cyphlon

1:1 Consultation Call

30 min Google Meet

An introductory call with our engineers about any engagement: a pentest, continuous testing, managed AppSec, security engineering, agentic AI security or a fractional CISO. We'll ask about your stack, your deadlines and what your customers or auditors expect, and tell you plainly if we're not the right fit.

Get started

Talk to an engineer, not a salesperson.

30 minutes with the engineers who would do the work. We'll tell you what we'd test first, and whether you need us at all.

Free 30-minute consultation · Google Meet

Logo Cyphlon

Research and tool releases by email

Unsubscribe any time. Privacy Policy

About Us

Cyphlon is a security engineering company. We implement DevSecOps, application security, Zero Trust and supply-chain security, build the products we deploy, and publish our research.

[email protected]

Company

Home About Cyphlon Solutions Services Products Research Trust Blog Contact Us

Services

DevSecOps Application Penetration Testing Supply Chain Security Zero Trust Architecture LLM Security

Products

Chainsaw DSO Acksess SHD Investigation Platform X-Security OpsMaxx LVCScan

Research

Backbone or Backbone-Architecture? A Controlled Study of LLM Agents on Web Penetration-Testing CTFs

© 2026 Cyphlon LLC · Dubai, United Arab Emirates · Founded 2016

Privacy Policy Terms of Use