Cyphlon is security engineering for companies without a full security team. We implement DevSecOps, application security, Zero Trust, supply-chain and agentic AI security, build and run the products we deploy, publish the research behind them, and work alongside your team until the controls are yours to run.
What we implement
Security controls built into pull requests, pipelines and deployments, with policy as code your engineers own.
Continuous code, dependency and secret scanning, external testing of running apps, and fixes you approve.
VPN replacement that checks every device and grants only the access each rule allows.
Malicious and typosquatted packages blocked at install time, with SBOMs and audit evidence.
Threat modelling, red teaming and guardrails for the AI agents, MCP servers and LLM features you run.
A fractional CISO, led by Zeeshan Sultan, who owns your security programme, audits and incident response planning.
Company
Zeeshan Sultan founded Cyphlon in Dubai in 2016. The team implements security for small and mid-sized companies that don't have a full security team, and builds the products and research that come out of that work.
Our team holds ISC2 CISSP, ISACA CISM, Offensive Security OSCP and ISC2 CCSP certifications.
Team
Founder & CEO
Zeeshan founded Cyphlon in Dubai in 2016 and leads its engineering and research work. He is the author of "Backbone or Backbone-Architecture?", a controlled study of LLM penetration-testing agents across 104 web CTFs and more than 2,700 audited runs, and publishes open-source security tools including LVCScan and X-Security.
Head of Compliance
Head of Finance and Operations
Advisory board
Our advisory board brings practitioners from banking, healthcare and govtech. They advise on our engagements in regulated industries and on the fractional CISO service, which Zeeshan Sultan leads.
See the fractional CISO engagement →Sectors represented
Products
Block malicious packages before they download.
Scheduled code scans, AI pentests, and fixes you approve.
Replace the VPN with access that checks every device.
AI-enabled data fusion and investigation for signals intelligence.
Research
A controlled study, by Cyphlon CEO Zeeshan Sultan, of what drives LLM agent performance in web penetration testing: the model, or the scaffold around it. Across the 104 single-flag CTFs of the XBOW validation suite, 9 agent scaffolds and 10 backbone models, more than 2,700 runs were scored on exact flag retrieval and every solve was audited. Holding the model fixed and changing only the scaffold moved the same backbone from 0 to 49 solves.
Book a call
Pick a time that suits you. We'll talk through what you're building and where your security stands, then suggest where to start.
Cyphlon
30 min
Google Meet
An introductory call with our engineers about any engagement: a pentest, continuous testing, managed AppSec, security engineering, agentic AI security or a fractional CISO. We'll ask about your stack, your deadlines and what your customers or auditors expect, and tell you plainly if we're not the right fit.
Cyphlon
About Us
Cyphlon is a security engineering company. We implement DevSecOps, application security, Zero Trust and supply-chain security, build the products we deploy, and publish our research.
© 2026 Cyphlon LLC · Dubai, United Arab Emirates · Founded 2016
