Our autonomous offensive-testing engine.
Vyra runs a disciplined, repeatable pipeline across the attack surface, so coverage does not depend on which day of the week a tester got to your target. A human operator drives exploitation and judgement. Vyra does not replace manual testing. It makes the manual testing count.
- phases, pt-00 to pt-09
- 11
- probe categories
- 27
- report formats
- 3
What Vyra is
An orchestration engine that runs the broad, repeatable parts of an assessment: discovery, mapping, and probing across a wide set of categories. It gives every engagement the same floor of coverage, and it flags candidates for a human to confirm and exploit.
What it is not
It is not a replacement for a tester. Automation is good at breadth and bad at judgement, chaining and business logic. Those stay with a senior operator. We are explicit about this because the opposite claim is how automated testing earns its bad name.
The pipeline
Eleven phases from scope to report. Phase pt-05b is a validation branch: a candidate is confirmed before it is ever trusted or exploited.
- pt-00
Scope intake
Load the agreed scope, limits and targets. Nothing runs outside it.
- pt-01
Recon and asset discovery
Enumerate the reachable surface from the scoped entry points.
- pt-02
Surface mapping
Map endpoints, parameters, auth flows and dependencies.
- pt-03
Fingerprinting
Identify stacks, frameworks and versions to focus the probes.
- pt-04
Automated probing
Run the probe categories broadly for coverage and consistency.
- pt-05
Vulnerability analysis
Correlate signals into candidate findings and rank by likely impact.
- pt-05b
Exploit validation
A validation branch that safely confirms a candidate before it is trusted.
- pt-06
Human-led exploitation
A senior operator takes over for chaining, bypasses and judgement calls.
- pt-07
Post-exploitation and impact
Establish what the access is actually worth, within scope.
- pt-08
Evidence collection
Capture reproducible evidence for every confirmed finding.
- pt-09
Reporting
Assemble the report in the formats your team needs.
Probe categories
The 27 categories Vyra covers on a web and API engagement.
- 01Recon
- 02Subdomain enumeration
- 03Port and service
- 04TLS and certificates
- 05HTTP security headers
- 06Authentication
- 07Session management
- 08Access control
- 09SQL injection
- 10NoSQL injection
- 11Command injection
- 12Template injection
- 13Cross-site scripting
- 14SSRF
- 15XXE
- 16Insecure deserialisation
- 17File upload
- 18Path traversal
- 19Open redirect
- 20CORS
- 21CSRF
- 22Rate limiting and abuse
- 23Secrets exposure
- 24API and GraphQL
- 25LLM and prompt injection
- 26Cloud and container misconfig
- 27Business logic
Vyra in the field
Vyra has surfaced real vulnerabilities, up to Critical severity, in authorized bug-bounty and coordinated-disclosure programs. Most stay under program disclosure terms, so we show what we can and link what you can check.
Publicly verifiable
Separately from the field reports above, our four credited CVEs in Oracle and WSO2 products are from 2020 manual research, each linked to the public record.
Findings Vyra surfaced in authorized bug-bounty and coordinated-disclosure programs; report identifiers are shown as filed, and most remain under program disclosure terms. Program names and marks belong to their owners; a reported finding does not imply affiliation with or endorsement by these organizations.
How it fits your stack
Vyra orchestrates proven tools, including browser automation and an intercepting proxy, through a single control layer, and it produces one coherent result. You receive the report in the format you work in.
- HTML
- JSON
Where it is going
The direction is continuous: recurring runs that watch a surface over time, so a new exposure is caught when it appears rather than at the next annual test. Human-led exploitation stays part of the loop.
See Vyra on your next engagement
Vyra ships as part of our testing, not as a box to run yourself. Scope an engagement and it does the heavy lifting underneath.