START HERE
COMPANY // SRI_LANKA 01
Software, IT & Cybersecurity Company in Sri Lanka
Ghost Protocol (Pvt) Ltd is a security-first software, IT, and cybersecurity company based in Colombo, founded in 2024 by Ryan Sebastian. We run penetration tests, build custom software on the Cloudflare edge, and ship an AI-memory layer — for Sri Lankan businesses and clients worldwide.
Colombo, LKAFounded 2024Global delivery
CAPABILITY 02
What we do in Sri Lanka
Three lines, one team. Security underwrites all of it — the people who build your software are the people who test it.
CYBERSECURITY
Security
VAPT, penetration testing, and security audits. A fixed-price $2,499 web-and-API pentest run by a senior engineer plus 75 AI scanners, against OWASP and NIST methodology, with a signed attestation. A free Ghost Scan gives you a same-day read on your exposure.
SOFTWARE
Software
Custom software, web applications, and Cloudflare-edge engineering — built security-first, not bolted on afterwards. Two engines are already productised: DragonScale for restaurant and commerce ordering, and DragonLair for hotel booking.
ARTIFICIAL INTELLIGENCE
AI
An AI-memory and intelligence layer for software that has to remember. Wyrm is a local-first MCP memory server; PhantomDragon AI is the pentest engine that drives the scanner stack. Both ship as products and as the backbone of our own delivery.
EVIDENCE 03
Real client work
Live deployments, not mockups. Each one is a Sri Lankan business running on software we built and maintain.
Upali's
Restaurant ordering
A premium ordering portal for a Colombo restaurant group — the live deployment that became the DragonScale commerce engine. Menus, payments, and admin, built on the Cloudflare edge.
VisionWorks
Studio web platform
A content-managed studio site rebuilt to editorial quality, with an admin surface the team runs themselves. Real, ongoing client work delivered from Colombo.
More live work and the engineering detail behind it sit in the portfolio and the case studies.
LANGUAGE 04
Trilingual capability
Delivery, documentation, and reports are written in English — the language enterprise procurement and global clients expect. That keeps a pentest report or a software handover instantly usable abroad.
For Sri Lankan businesses, the team supports Sinhala and Tamil in client communication. A local restaurant, hotel, or startup is never forced into a second language to brief a project or read a quote. It is a named capability, not a constraint on the work.
English — delivery Sinhala — supported Tamil — supported
MODEL 05
A Sri Lanka base, global delivery
The Colombo base is deliberate. Senior engineering here runs at a fraction of US and European rates, which is how a full web-and-API penetration test lands at a fixed $2,499 and a custom build stays affordable — without thinning out the seniority on the work. The economics are the advantage; the quality bar does not move.
The team is remote-first. Software ships on the Cloudflare edge, so a deployment serves a customer in Colombo and one in London from the same infrastructure with the same latency story. Scope, methodology, and deliverables are identical wherever the client sits.
That is the whole shape of it: built in Sri Lanka, delivered worldwide, security-first by default.
Colombo-based
Registered in Sri Lanka, founded 2024.
Edge-native
Cloudflare Workers, D1, R2 — global by default.
Worldwide
Remote delivery to clients in any timezone.
QUESTIONS 06
Frequently asked questions
Is Ghost Protocol a Sri Lankan company?
Yes. Ghost Protocol (Pvt) Ltd is a software, IT, and cybersecurity company based in Colombo, Sri Lanka, founded in 2024 by Ryan Sebastian. The team works remote-first and delivers to clients in Sri Lanka and worldwide.
What does a software and IT company in Sri Lanka actually offer here?
Three lines: cybersecurity (VAPT, penetration testing, security audits, a fixed-price $2,499 pentest), custom software and web development including Cloudflare-edge engineering, and an AI layer (the Wyrm memory server and the PhantomDragon AI pentest engine). Every line is security-first.
Do you only work with Sri Lankan clients?
No. A Colombo base keeps engineering costs sane, but delivery is remote and global. We work with clients in Sri Lanka and overseas, and the scope, methodology, and deliverables are identical regardless of where the client sits.
Can you work in Sinhala and Tamil?
Public delivery and documentation are in English. The team supports Sinhala and Tamil for client communication where it helps, so a Sri Lankan business is never forced into a second language to work with us.
How is the cybersecurity work different from a generic IT company?
Security is the starting point, not an add-on. The same team that builds your software runs the penetration test against it, so findings come from people who understand the architecture. The security cluster has its own home at the penetration-testing-in-Sri-Lanka guide.
Start with a free scan and a 15-minute call.
Tell us what you are building or protecting. The Ghost Scan gives you a same-day read on your exposure; the call decides where security, software, or AI fits. Colombo-based, delivered worldwide.
COLOMBO // GLOBAL_DELIVERY // SECURITY_FIRST