🕸️
AI-Driven Web & API Pen Testing
Autonomous agents plus hands-on testing of authentication, authorization, injection, and business-logic flaws.
Independent Security Research Lab · Belgium
AI-driven pen testing & red teaming research.
Syrah is an independent security research lab. The lab experiments with autonomous AI agents and hands-on offensive security: pen testing, red teaming, hardware, and open tooling, shared with the community.
AI-driven
Agents + hands-on research
Red-team
Adversary simulation & tooling
Coming soon
Open-source tooling & write-ups
What the lab works on
Research areas, not a service menu. AI-driven at the core — agents for breadth, hands-on work for depth.
📱
Mobile Application Security
Static and dynamic analysis of Android and iOS apps: data storage, crypto, IPC, deep links, and network defenses.
🔌
Hardware Security
Embedded and IoT experiments: firmware analysis, debug interfaces, secure boot, and key storage.
🧪
Red Teaming & Adversary Simulation
AI-assisted red-team scenarios that test detection and response, not just perimeter gaps.
🔎
Vulnerability Research
Deep-dives into specific components and protocols, with responsible disclosure when issues are found.
⚙️
Tooling & Automation
Scripts and experiments that turn one-off findings into repeatable, open-source-friendly checks.
📄
Write-ups & Proof-of-Concepts
Reproducible PoCs and notes on what worked, what didn't, and why — published when possible.
🎓
Learning & Sharing
CTFs, lab notes, and lessons from building AI-driven offensive security workflows.
🤝
Collaboration
Open to like-minded researchers, CTF teams, and anyone working on similar problems.
Open source
Coming soon — the lab's public tooling and research are in the works.
How the lab works
A simple research loop: agents do the breadth, hands-on work goes deep.
1
Pick a target
An app, a device, a protocol, or an AI system worth poking at — usually something the lab finds interesting.
2
Test & break
Autonomous agents map the attack surface while hands-on work validates, chains, and digs into the weird parts.
3
Document
Reproducible proof-of-concepts, notes on what worked, and honest takes on what didn't.
4
Disclose & share
Responsible disclosure when needed, then publish write-ups and tooling for the community.
Get in touch
Questions, research ideas, a bug to discuss, or just want to compare notes — email the lab.
[email protected]Security contact & PGP
Found something, or want to reach out securely? Email [email protected] — encrypted with the lab's PGP key if you can.
PGP fingerprint
BE8B 1754 C383 540D D9E8 5ED8 4017 74F3 AA5D A9E4 🔑
Public keyBE8B 1754 C383 540D D9E8 5ED8 4017 74F3 AA5D A9E4 🔑
pgp-key.asc — Syrah sec <[email protected]> · RSA 4096 ↓