CySec
The CySec app icon: a crimson shield on a near-black ground.

Thousands of security problems are reported every month. A handful are yours.

Tell CySec what you run. It reads the public security sources every few minutes and tells you, in plain words, which of it touches you — early enough to do something about it.

Download on the App Store

iPhone (iOS 26 or later) and Apple Watch (watchOS 26 or later)

What CySec is for

Four things, in this order.

To make you aware of your exposure. To teach you as you go, if this is new to you. To let you decide and act — or explain it to someone who will. And to be early, because most of the cost of a security problem is in the time before anyone notices it.

CySec does not assume you are a security professional. It never uses an acronym without explaining it, and never shows you a score without saying what the score means.

How it works

Three steps, and then it runs on its own.

  1. Tell it what you run

    Products — Windows, Chrome, a router, a firewall, a cloud service. If you write software, the libraries your code depends on, read from a lockfile or a bill of materials. That list is your environment.

  2. CySec reads the world

    Every few minutes: CISA's Known Exploited Vulnerabilities list, the National Vulnerability Database, the CVE programme, GitHub's advisory database, Microsoft's Security Update Guide including Patch Tuesday, vendor advisories and security news.

  3. You hear about what touches you

    Matching happens on your phone. The Radar shows what needs attention, in tiers. The Feed shows everything. Your wrist gets the same alerts, and you can mark something seen from the Watch.

The Radar

Four tiers, in the app's own words. Above them sits a threat level — Critical, High, Elevated, Guarded or Normal — with one sentence saying why.

  • Immediate action
    “You run it, and it is being attacked now.”

    Something you run, confirmed by a credible source to be under active attack in the last two weeks, that you have not dealt with.

  • Review today
    “You run it, and CySec ranks it urgent.”

    Yours, ranked high, but not confirmed under attack.

  • Changed since last view
    “Something about them moved since you last looked.”

    An item you have already seen, where the facts have changed.

  • Watching
    “Near you, but not confirmed as yours.”

    Close enough to your environment to be worth knowing about, without claiming it is yours.

What it looks like

Real screens from the app, running against live data.

The Environment screen listing 86 products such as Adobe Acrobat, Amazon Web Services and Apache Tomcat, with the note: add what you actually run; CySec matches every advisory against it on this iPhone; only product names are ever sent, and only while that switch is on.
Start by telling CySec what you run. The matching happens on the phone — only product names ever leave it, and only if you let them.
The Radar screen. Under Your estate, Threat level Critical with the line: something you run is confirmed to be under attack now. Below it the four tiers with counts: Immediate action 10, Review today 148, Changed since last view 0, Watching 478, then Campaign activity and Companies you rely on.
The Radar: the threat level, one line saying why, and the four tiers with today’s counts.
The Immediate action list, showing two Microsoft items: Patch Tuesday September 2026 and Microsoft Plugs Nearly 1,000 Security Holes. Each says the US government has confirmed this is being attacked right now and a fix is available, and is marked: you run this, CySec 92.
Immediate action, opened up. “The US government has confirmed this is being attacked right now.”
An item screen. CySec Priority 92, Critical, tagged KEV: Patch Tuesday September 2026, from the Rapid7 blog. An Ask CySec button, then Your environment: You run this; the source lists something you told CySec you run, but which versions you have is not recorded, so whether this particular problem reaches you is not known. How sure CySec is: product only.
Every item says how sure CySec is. Here it knows you run the product but not which version — so it tells you that, rather than guessing.
The Feed, newest first, each item with a severity label and a plain-English line beneath the headline, such as: working attack code for this is public, so anybody can use it.
The Feed: everything, newest first, each with a plain-English line under the headline.
The Pulse screen, headed What is happening in the industry, summarising the week and noting that CySec's 0-to-100 ranking is its own reading of urgency, not an official score.
Pulse: the industry beyond your own environment — and every number explained, not just shown.
The Your estate screen: 86 products, 1,677 open, 5 under attack, 0 resolved in 30 days, then one row per product, worst first, each with how many items are open, under attack and have a fix, and when it last moved.
Your estate: one row per thing you run, worst first, with what is open, what is under attack, and what has a fix.
The Companies you rely on screen. Under What happened to them, a fictional company, Northwind Freight, marked: posted to a leak site, a claim, unverified. Below it the note that a leak-site posting is a claim by a criminal group, not a confirmed breach.
Name the companies your data sits with. When one is posted to a leak site or listed in a confirmed breach, you are told — and told which of the two it is.
The Look up screen with ShinyHunters typed in the search field. Under Threat actors, the catalogue entry with its 30-day leak-site claim count; under In the news and advisories, the reports that name the group, each with its source and date.
Look anything up — a company, a threat actor, a product, a CVE — and see what is known, labelled by how sure it is.
The CySec Apple Watch app showing Critical, 24 critical relevant, 0 changed, and a triage list.
The same numbers on your wrist, and you can mark something seen from there.

Captured on iOS 26 against a sample environment and a fictional company, not real ones.

Pulse and Ask CySec

Pulse

The world beyond your environment: what is being attacked this week, what just got a fix, what people in the field are talking about — whether or not it touches you, so you are never the last to know.

Ask CySec

Ask about any item and get an answer in plain language. It runs on your phone using Apple Intelligence; nothing leaves the device. You can optionally connect your own Claude account for longer answers — the app shows you exactly what it would send before it sends anything, and the feature is off until you turn it on.

What we know about you

Short version. The privacy policy is the long one.

  • No account. No sign-in. We never ask for your email address.
  • No analytics, no advertising identifiers, no trackers — in the app or on this website.
  • Your environment, your notes and your decisions stay on your phone.
  • If you turn on environment sync so alerts can be pushed to you, our server learns the names of the products you run, and nothing else — never versions, never your components, never anything you typed.
  • Turn sync off and your phone does all the matching itself. Then the server knows nothing about what you run.
  • We do not sell, rent or share any of it.

Price

$4.99 a month

$39.99 a year

Seven-day free trial first. One subscription covers iPhone and Apple Watch. Billed through Apple; it renews unless you cancel at least 24 hours before the period ends, and you can cancel any time. Prices are US dollars; Apple sets the rest.

One honest limit

CySec tells you what is publicly known. It does not stop attacks, patch anything, or promise you are safe — you or your IT team act on what it shows you. Public sources are sometimes wrong and sometimes late, and where CySec knows that, it says so.