# Ghost Protocol (Ghosts)

> Cybersecurity and security-first software engineering company in Colombo, Sri Lanka, delivering worldwide. Founded 2024 by Ryan Sebastian. Fixed-price web and API penetration testing ($2,499, one-time), a free website security scan, and production security tools.

## Security services

- [Free Ghost Scan](https://ghosts.lk/scan): Free website security scan. No card, no signup. Checks your site across 9 categories and shows what an attacker sees first.
- [Penetration Testing (VAPT)](https://ghosts.lk/pentest): Fixed-price $2,499 web and API penetration test. One real engineer plus 75 AI scanner modules, OWASP/NIST coverage, executive PDF in 5 to 7 days, free re-test, signed attestation letter.
- [Sample Report](https://ghosts.lk/pentest/sample-report): What a Ghost Protocol penetration test report and attestation letter contain.
- [SOC 2 Penetration Testing](https://ghosts.lk/pentest/soc-2-penetration-testing): What auditors actually require and accept for SOC 2, and the evidence pack we deliver.
- [ISO 27001 Penetration Testing](https://ghosts.lk/pentest/iso-27001-penetration-testing): A.8.8 vulnerability identification, annual cadence, and retest evidence.
- [Pricing](https://ghosts.lk/pricing): Transparent pricing. Free scan, $499 one-time deep scan, $2,499 fixed penetration test, $2,999/mo security retainer.
- [Penetration Testing in Sri Lanka](https://ghosts.lk/penetration-testing-sri-lanka): VAPT for Sri Lankan companies, from Colombo.
- [Cybersecurity in Sri Lanka](https://ghosts.lk/sri-lanka): Sri Lanka services hub.

## Guides

- [How Much Does a Penetration Test Cost?](https://ghosts.lk/blog/penetration-testing-cost): 2026 market ranges with sources, the real cost drivers, and our actual price.
- [Penetration Testing vs Vulnerability Scanning](https://ghosts.lk/blog/penetration-testing-vs-vulnerability-scanning): A scan finds, a pentest proves. When each is enough.
- [Your First Penetration Test](https://ghosts.lk/blog/first-penetration-test-startup): Unblocking enterprise security reviews and audits.
- [VAPT in Sri Lanka: Buyer's Guide](https://ghosts.lk/blog/vapt-sri-lanka-guide): What VAPT should cost and the questions to ask any provider.
- [AI Penetration Testing vs Human Pentesters](https://ghosts.lk/blog/ai-penetration-testing-vs-manual): What 75 scanners can and cannot find.
- [Blog](https://ghosts.lk/blog): Security engineering, AI memory, and case studies.

## Products

- [Wyrm](https://ghosts.lk/wyrm): AI memory and intelligence layer. 137-tool MCP server behind a frozen 32-verb surface. Local-first, works with Claude, ChatGPT, Copilot, Cursor, Windsurf, Codex. npm: wyrm-mcp.
- [PhantomDragon AI](https://ghosts.lk/phantomdragon-ai): AI penetration testing engine. 50 modules, 17-phase pipeline, 75+ scanners, human-verified findings.
- [DragonScale](https://ghosts.lk/dragonscale): Self-hosted commerce platform for restaurants, retail, and services. Zero commissions.
- [DragonHunt](https://ghosts.lk/dragonhunt): OSINT and reconnaissance framework.
- [DragonLair](https://ghosts.lk/dragonlair): Hotel booking and property management system.

## Software engineering

- [Services](https://ghosts.lk/services): Security-first custom software, web applications, and Cloudflare edge engineering.
- [Case Studies](https://ghosts.lk/case-studies): Real client work with real numbers.
- [Portfolio](https://ghosts.lk/portfolio): Project debriefs.

## Company

- [About](https://ghosts.lk/about): Ghost Protocol (Pvt) Ltd, Colombo. Founded 2024 by Ryan Sebastian. Member of the NVIDIA Inception program.
- [NVIDIA Inception announcement](https://ghosts.lk/blog/ghost-protocol-joins-nvidia-inception): Ghost Protocol is a member of the NVIDIA Inception program (July 2026).
- [Contact](https://ghosts.lk/contact): ryan@ghosts.lk, +94 71 055 5055.
- [GitHub](https://github.com/Ghosts-Protocol-Pvt-Ltd)
- [LinkedIn](https://linkedin.com/company/ghost-protocol-lk)
- [X](https://x.com/GhostProtocolLk)