It reads the attack, names it, and shuts the door — in the same breath.
CyberGuard watches the traffic reaching your servers, recognises hostile requests against 19 attack classes — from SQL injection to prompt injection — blocks the source, and tells your team in plain language what just happened and what to do about it.
Classic attacks and AI-era attacks, on the same wire.
Most tools were built before an attacker could target your language model instead of your database. CyberGuard inspects the same request for both, and maps every finding to MITRE ATT&CK or MITRE ATLAS so it lands in the vocabulary your analysts already use.
Web & application
9- SQL InjectionT1190
- Command InjectionT1059
- Log4Shell · Spring4Shell · Text4ShellT1203
- Cross-Site ScriptingT1189
- Path TraversalT1083
- File Inclusion & SSRFT1190
- Template InjectionT1059
- XML External EntityT1190
- Sensitive File ProbeT1595.003
Network & behavioural
5- Scanner & recon toolingT1595
- Brute-force loginT1110
- Port scanT1046
- Request flood / DoST1498
- Known-malicious sourceT1595
These three carry no signature at all — they are caught by rolling per-source counters you tune to your own traffic.
AI & LLM
5- AI Agent HijackingAML.T0053
- Prompt InjectionAML.T0051
- LLM JailbreakAML.T0054
- AI Data ExfiltrationAML.T0057
- System Prompt ExtractionAML.T0056
Mapped to the OWASP Top 10 for LLM Applications. If you run a chatbot or an agent, this is your exposed surface.
Eight steps between a request arriving and your phone ringing.
Detection that only produces a dashboard is a report, not a defence. Every event runs the same path, and the decision at each stage changes what the next one does.
Drop self-traffic
Health checks and local proxies are infrastructure, never attackers.
Log everything
Hostile or not — the baseline needs the full picture.
Score the source
Reputation checked against offline blocklists before any payload is read.
Inspect the payload
Signatures and behavioural counters together; worst match becomes the headline.
Decide the block
By severity, or because intel already knows the source is hostile.
Locate and record
Geography, network owner and hardware attached, then pushed to the live map.
Open a case
Serious hits become CVSS-scored findings on a triage board, deduplicated.
Reach a human
SMS, email and a voice call that reads the alert aloud.
Watch first. Enforce when you are ready.
Two honest modes, and we will tell you plainly which one you are in. A tool that claims to protect while only observing is worse than one that admits it.
Alongside your servers
A collector tails your existing nginx, Apache and SSH logs and feeds them in. Nothing sits in the traffic path, so nothing can break. You see the attack — after your application already answered it.
In front of your site
A reverse proxy screens every request and returns 403 before it
reaches your application. It fails open by design — if the guard is unreachable,
traffic still flows. Your site never goes down because the firewall did.
Runs on a single Debian server. The blocklists, the IP-to-country database and the analyst explanations all work offline — no traffic of yours leaves your infrastructure, and nothing stops working if the internet does.
Six views, one operating picture.
Built to be readable by an executive at a glance and useful to an analyst at 3 a.m.
SOC dashboard
Live threat feed, severity bands, active blocks and the current threat level.
Attack map
Every attacker geolocated, with an arc drawn from its city to your server. The camera follows whatever just landed.
Threat globe
The same data as a rotating 3D globe for a wall display.
Command centre
Globe, map and a tactical radar side by side, with a DEFCON gauge and analytics by type, region and severity.
Findings board
Detections become CVSS-scored cases on a kanban — open, triaged, in progress, resolved — with evidence and a full audit trail.
Learn
Every rule the engine runs, its MITRE mapping and its remediation — read live from the running engine, so the reference can never drift from reality.
Designed for organisations that cannot outsource their perimeter.
Built in Addis Ababa for institutions that need their security data to stay on infrastructure they control, on connectivity they cannot always rely on, and in a budget that does not assume a foreign SOC contract.
Priced per protected server.
Every plan starts with a 14-day trial in observe-only mode. Nothing is blocked until you decide it should be, and there is nothing to uninstall if you walk away.
Starter
One server, one team. The whole detection engine, nothing removed.
Start free trial
- 1 protected server
- All 19 attack classes, all 24 rules
- OWASP Core Rule Set included
- Email alerts
- 30-day evidence retention
- Inline blocking (observe only)
- SMS and voice callout
Best for a single public website or API.
Professional
The working configuration: inline blocking, real alerting, a case record for every incident.
from 5 servers
Start free trial- 5 to 50 protected servers
- Everything in Starter
- Inline WAF — blocks before the request lands
- SMS, email and voice callout
- CVSS-scored findings and case history
- Attack map, 3D globe and AI intel briefs
- Roles: viewer, analyst, admin
- 1-year evidence retention
Best for a bank, an ISP, or anyone who has to answer to a regulator.
Enterprise
Your hardware, your network, your rules. Nothing leaves the building.
annual agreement
Contact sales- Unlimited servers
- Everything in Professional
- Fully air-gapped — no external calls, ever
- Custom detection rules written for your stack
- Named engineer and response SLA
- On-site installation and operator training
- Retention you set
Best for government, defence and critical national infrastructure.
Prices are in USD, excluding VAT. Ethiopian customers may be invoiced in ETB at the
prevailing rate.
Not sure how many servers you have exposed? Ask us to measure it —
that part is free.
The things people actually ask.
Will it block my real customers?
That is the right question, and it is why every trial starts in observe-only mode. For the first two weeks CyberGuard scores traffic and records what it would have blocked, without blocking anything. You read that list against your own traffic and decide. If the false-positive rate is not acceptable to you, you have lost nothing.
Does my traffic leave my network?
No. Detection, reputation scoring and geolocation all run locally against datasets shipped with the product — 5,958 threat indicators held offline. The only traffic that leaves is the alert you asked us to send, over the channel you configured. Enterprise installations can be fully air-gapped.
Where does it sit?
Two ways, and you can run both. Passively, a log shipper tails your existing nginx, Apache or sshd logs and reports what reached you — no change to your serving path. Inline, a reverse proxy sits in front of your origin and returns 403 before the request ever arrives. Passive is safe to switch on today; inline is what actually stops an attack.
What happens to the data you hold?
It stays on the server you installed it on. We do not operate a cloud that your events are shipped to. Retention is yours to set, and pruning is enforced by the product rather than by a promise.
Can I see what it has already caught, before buying?
Yes, and it is the fastest thing we can do for you. Point the shipper at an access log you already have and CyberGuard replays it with the original timestamps. In a recent test, 4,000 log lines produced 180 dated findings — attacks that had already reached that server, that nobody had looked at.
Who is behind it?
S.R.E Manufacturing and Trading P.L.C., in Addis Ababa. The product is built in Ethiopia, supported from Ethiopia, and does not depend on a foreign service staying available for your defences to work.
Start in observe mode. Decide from evidence.
Tell us about your environment and we will deploy CyberGuard against your real traffic in watch-only mode. You see exactly what it would have blocked, on your own data, before anything is ever enforced.
You are on the list
We will be in touch within one working day.