Resources
Case studies of work we delivered, articles, our own security research, and the tools and documents we give away. All of it is free to read.
Case studies
Written accounts of work we delivered, with the figures we measured afterwards.
Multi-agent operations team (anonymized)AI agent operations
Memory is not the moat, judgment is
100/100 negative-learning firewall, recall / precision · 3,395 tests in the Wyrm suite · 25 sources reviewed for the study
Forward-deployed operator (anonymized)AI memory, solo operations
One operator, thirteen projects, zero dropped context
77 sessions held · 257 threads resumed · 13 projects in one memory
Upali's, ColomboRestaurant, food and beverage
How we digitized a traditional restaurant in 2 weeks
$0 monthly hosting after the Cloudflare rebuild · 0% commission on the restaurant's own orders · 3 languages: English, Sinhala, Tamil
Articles
What we have written about testing, buying a test, and the software we build.
Research
Sri Lanka web security census 2026
A passive check of the public websites of companies listed on the Colombo Stock Exchange: which standard protections they switch on. Aggregate figures only; no company is named.
Company
Ghost Protocol joins the NVIDIA Inception Program
Ghost Protocol joined the NVIDIA Inception program in July 2026. What the program is, and what membership changes for our clients on NVIDIA hardware.
Security
How much does a penetration test cost? (2026, with our actual price)
Published 2026 guides put a web app pentest at $5,000 to $35,000+. Ours is $4,000 fixed. Every cost driver, pricing model, and hidden fee, with real numbers.
Security
Your first penetration test: unblocking the enterprise security review
An enterprise prospect asked for pentest evidence. The five triggers, what security questionnaires ask, what to send, and how startups unblock the deal in days.
Security
VAPT in Sri Lanka: an honest buyer's guide
What VAPT costs in Sri Lanka, how to spot a scanner report sold as a pentest, what the PDPA actually requires, and 10 questions to ask any VAPT provider.
Engineering
Why your AI forgets everything (and how Wyrm fixes it)
AI assistants lose all context between sessions. Learn how MCP servers and persistent AI memory like Wyrm solve the context window problem for developers.
Security
The real cost of a data breach for small businesses
The average data breach costs $4.88 million. For small businesses, it can mean closing the doors. Here's the full breakdown of what a breach really costs.
Security
Why your web app needs a penetration test before launch
Most teams skip security testing until it is too late. How automated penetration testing catches OWASP Top 10 vulnerabilities before attackers do.
Engineering
Building AI memory systems: lessons from Wyrm
How we built a persistent AI memory system that compounds knowledge across 15+ projects, and why every engineering team needs one.
Research
Security tests we ran ourselves, and what they found.
Security
I ran 75 automated scanners against my own app: here's what broke
Most companies test with 1-2 scanners. We built an AI that orchestrates 75. Here's what a 17-phase automated penetration test actually finds.
Security
Penetration testing vs vulnerability scanning: we ran both on the same app
A scan finds possible vulnerabilities. A pentest proves what an attacker can do. We ran 75 scanner modules on our own app; here is what each method caught.
Security
AI penetration testing vs human pentesters: what 75 scanners can and cannot find
What AI pentest tools catch and what they miss in 2026: coverage vs business logic, real examples from our 75-scanner run, and the economics of hybrid testing.
Free resources
Tools and documents anyone can use. No signup, no payment.
Tool
Ghost Scan
Checks one website's certificate, security headers, DNS and cookies in under a minute. No signup.
Tool
Which security obligations apply to you
Answer four questions about your organisation and see which Sri Lankan security obligations reach you, each cited to a named instrument. It runs in your browser.
Report
Example penetration test report
The report a test delivers, written against a made-up client: the summary for management, every finding rated, and the evidence behind each one.
Software
Wyrm
Memory for AI coding agents. Free on your own machine, with no account needed.
Documents
Vendor review details
Company details, policies and the documents a procurement team usually asks for, in one place.
Talk to an engineer
Email ryan@ghosts.lk or message +94 71 055 5055 on WhatsApp. Ryan replies within 24 hours. Working hours are Monday to Friday, 09:00 to 18:00 Colombo time (UTC+5:30).
Book a 15-minute call Buying for a company? Procurement details