We test your systems the way an attacker would, and show you what to fix.
Fixed-price penetration testing from Colombo, for companies in Sri Lanka and abroad. Ryan Sebastian, our founder, leads every engagement and signs the attestation letter. The re-test after you fix is included.
Free, and it takes under a minute. What we keep
A member of the NVIDIA Inception program
“We were able to create an administrator account on the Northwind Retail application from the public internet, without a password… That single weakness gives an attacker the whole customer database. It is fixed now.”
- 1Critical
- 2High
- 2Medium
- 1Low
- 1Info
| ID | Finding | Severity | CVSS | Re-test |
|---|---|---|---|---|
| GP-NWR-01 | Mass assignment on customer registration grants the administrator role | Critical | 9.8 | Fixed |
| GP-NWR-02 | Broken object-level authorisation on order read and update | High | 8.1 | Fixed |
| GP-NWR-03 | Server-side request forgery in the product image importer | High | 7.7 | Fixed |
| GP-NWR-04 | No rate limiting or lockout on authentication and password reset | Medium | 6.5 | Open |
| GP-NWR-05 | Stored cross-site scripting in the order note, rendered by the staff console | Medium | 5.4 | Fixed |
| GP-NWR-06 | Session cookie issued without the Secure attribute, with SameSite=None | Low | 3.7 | Accepted |
| GP-NWR-07 | Framework and version disclosed in response headers and error pages | Info | n/a | Fixed |
The 3 most severe of 7 findings.
Our clients, and the live work we built for them
Clients who chose to be named. Each address is the live site we built, so you can check it yourself.
- order.upalis.com
Upali's
Restaurant · Ordering platform, built from scratch, run on DragonScale
- visionworkslk.com
Vision Works
Production house · Website
- biofuellanka.com
Bio Fuel Lanka
Renewable energy · Website
- intotheprompt.com
Into The Prompt
AI courses · Website
Ghost Protocol (Private) Limited · Company No. PV00305227 · Colombo, Sri Lanka · NVIDIA Inception program member · Wyrm on npm
A small company that does the work itself
Ghost Protocol was incorporated in Colombo in 2024. Ryan Sebastian, our founder, leads every engagement, and we build the tools we test with, so the people you speak to are the people doing the work.
What a penetration test gives you
$4,000, fixed. Re-test included. Companies registered in Sri Lanka have a local rate card.
- An executive report in plain English, with every finding rated and explained.
- A signed attestation letter for auditors, customers and investors.
- Developer findings in JSON and SARIF, ready for your ticket system.
- A free re-test after you fix, and an updated report.
Auditors and regulators can take the report as evidence for ISO 27001 (A.8.8 and A.8.29), SOC 2 (CC4.1), PCI DSS (requirement 11.4), the Central Bank of Sri Lanka’s Technology Risk Management and Resilience Directions, and the security duty in Sri Lanka’s Personal Data Protection Act. A test is evidence toward each of these, not compliance on its own. See which apply to you.
From booking to re-test, within 30 days
- Day 0
Book
A 15-minute call. We confirm the scope, sign the engagement letter, and you send the target details.
- Days 1 to 5
Test
On day 1, PhantomDragon, our scanning engine, sweeps the surface in a few hours. Then, to day 5, the engineer tests by hand: business logic, and attacks that chain several steps.
- Days 5 to 7
Report
An executive PDF, developer JSON and SARIF, a reproducible proof for every high-severity finding, and a signed attestation letter.
- Days 7 to 30
Re-test
Once you patch, we test again and reissue the report at no extra charge. Questions stay open for 30 days.
Wyrm, our memory for AI coding agents
Wyrm gives AI coding agents a memory that lasts between sessions, and stops them repeating mistakes they have already made. It is free, and it runs on your own machine.
- 100%
- of repeated mistakes blocked in the published benchmark (16 of 16), with no false blocks on new actions
- ~0.3 ms
- to check an action before it runs, at the median
- 154
- tools an agent can call, all free to use on your own machine
npm install -g wyrm-mcpAlso from Ghost Protocol
Services
- Custom software
Web applications and Cloudflare edge systems, built security-first.
- AI and automation
AI agents, automation and search over your own documents, built into working systems.
- Security retainer
A pentest every quarter, a monthly deep scan and a re-test on every fix. $899 a month, six-month minimum.
- Regulated and enterprise work
Scoped to your regulator’s specification, with board-format reporting and purchase orders. From $8,000.
Products
- DragonScale
A self-hosted ordering and commerce platform for restaurants, retail and services, with no monthly fees or commissions.
- DragonLair
A hotel booking platform: reservations, activity booking and an admin dashboard.
- DragonHunt
An OSINT and reconnaissance tool: domain recon, subdomain discovery and email security checks.
- PhantomDragon AI
The scanning engine our engineers run on every test. Every finding it raises is checked by hand before it reaches a report.
Talk to an engineer
Email ryan@ghosts.lk or message +94 71 055 5055 on WhatsApp. Ryan Sebastian replies within 24 hours.
We work Monday to Friday, 09:00 to 18:00 Colombo time (UTC+5:30).
Book a 15-minute call Buying for a company? Procurement details
