Discover
Build an inventory from authorized domains, IP addresses, services, certificates, DNS records, and public identities.
Defensive intelligence platform
Follow every signal.Prove every finding.
CYPHERYN turns authorized OSINT, attack-surface observations, and threat intelligence into evidence you can inspect, compare, and act on.
- —
- Registered users
- Passive-first
- Safe collection by default
- Source-linked
- Every claim retains evidence
- Local AI
- Constrained, private summaries
One evidence workspace
Know what is exposed, why it matters, and whether the fix worked.
CYPHERYN is a local-first cyber-intelligence platform for defenders, security engineers, and authorized assessors. It combines collection, normalization, graph analysis, finding management, and continuous verification without treating a provider response as unquestionable truth.
Enrich
Query installed intelligence providers and preserve the source, retrieval time, target, payload hash, and authorization context.
Correlate
Connect entities and observations in an evidence graph so analysts can trace why a finding exists and what it affects.
Improve
Prioritize findings, explain likely attack paths, track remediation, schedule rescans, and verify security changes over time.
Intelligence you can defend
From raw observations to clear action.
Evidence, not guesses
Normalize provider responses into source-linked entities, relationships, findings, and defensible claims.
Continuous visibility
Schedule rescans, compare evidence over time, acknowledge changes, and track findings through resolution.
Local-first intelligence
Keep provider credentials encrypted locally and generate constrained narratives without sending evidence to hosted AI.
Attack-surface discovery
Map domains, DNS, certificates, public services, identities, and related infrastructure inside an explicitly authorized scope.
Threat enrichment
Bring provider verdicts, pulse matches, malware associations, and reputation records into one consistent evidence model.
Remediation verification
Rescan known assets, compare evidence snapshots, and show whether an exposure is new, persistent, changed, or resolved.
Two perspectives. One authorization boundary.
Understand the attacker's view. Operate as a defender.
CYPHERYN supports defensive monitoring and authorized offensive analysis. Active collection is scope-controlled, auditable, and separated from the evidence used to support conclusions.
Reduce uncertainty across your environment.
- Inventory externally visible assets and services.
- Prioritize evidence-backed exposures and threat associations.
- Track owners, status, remediation notes, and verification history.
- Detect changes through scheduled monitoring and comparison.
See how permitted targets appear from the outside.
- Model relationships an attacker could use for reconnaissance.
- Identify public services, weak posture, and unexpected exposure.
- Explain plausible attack paths without overstating the evidence.
- Keep active testing constrained to recorded, approved scope.
The operating loop
Scope. Collect. Correlate. Monitor.
- 01Authorize scopeRecord exactly what may be observed.
- 02Run providersCollect durable, normalized evidence.
- 03Investigate graphTrace entities, services, and claims.
- 04Watch changeRescan and manage the finding lifecycle.
How the platform works
A complete path from authorization to verified remediation.
CYPHERYN is not a page of disconnected lookups. It is an operational system that keeps collection, provenance, analysis, and change history together throughout an investigation.
Authorized workspace
Analysts define the target, ownership, purpose, and permitted collection boundary before work begins.
Durable collection
Workers run provider jobs asynchronously, preserve status and retries, and normalize observations into a common model.
Evidence and correlation
Entities, relationships, provider payloads, hashes, timestamps, and claims remain connected in one reviewable record.
Verification loop
Monitoring, rescans, comparisons, alerts, and finding lifecycle controls show what changed and whether remediation held.
Local-first by design
Deploy with containers on macOS, Windows, Linux, or private infrastructure. PostgreSQL preserves operational data, Redis coordinates durable jobs, isolated runners handle active tools, and optional providers extend the platform without becoming a requirement for basic operation.
Security boundaries
Built for evidence that has to survive scrutiny.
Cybersecurity software should make its boundaries visible. CYPHERYN records what was authorized, separates observations from conclusions, limits active execution, and tells operators when a capability has actually been verified—not merely listed.
Authorization first
Passive and active operations retain scope and authorization context.
Isolated active tools
Higher-risk scanners run through a separately trusted, resource-bounded orchestrator.
Secret-conscious operation
Provider credentials stay encrypted and are excluded from evidence, logs, and tool environments.
Tamper-evident evidence
Linked integrity records and signed checkpoints make unauthorized history changes detectable.
Private analyst assistance
Local AI can explain evidence without making unsupported findings or replacing analyst judgment.
Provider truthfulness
Readiness distinguishes supported, installed, configured, healthy, and live-verified integrations.
Trust through verification
Built to preserve the difference between data, evidence, and judgment.
Provenance retainedProvider, target, time, authorization, and payload integrity travel with collected evidence.
Capabilities verifiedProvider readiness progresses from supported to installed, configured, healthy, and live verified.
Changes remain reviewablePrevious and current evidence stay available so a closed finding can be independently checked.