About CyberDebunk

Cybersecurity, in plain English.

We started CyberDebunk because the people who actually ship software shouldn't need a translator to understand what's vulnerable, why it matters, and what to do next.

The industry talks to itself. We talk to the rest of you.

Most security tools are built by red-teamers, for red-teamers. They drop a CSV of CVE-2024-XXXXX into your sprint and call it a day. That's not security, that's homework.

We build the opposite: tools that translate threat intel into "here's what's broken, here's why a bank-robber would care, here's the patch." A scanner anyone on your team can read. A GDPR companion that doesn't quote articles at you. A Companion that won't make things up.

If we do our job, security stops being an audit you fail and starts being a habit you keep. Less FUD. More fixed.

We didn't want another dashboard with red numbers. We wanted the security team's intern to be able to read it on their first day, and the CTO to actually trust the answer.

Our product principle

Written on the first day, still on the wall.

Data residency, by default

Frankfurt & Amsterdam regions

300k+

CVEs in our live database

Refreshed every 15 minutes

SOC 2

Trust & security programme

Type II audit in progress (see Privacy Policy)

24/7

Continuous scanning

From Berlin & Amsterdam

What we believe

A short version of why CyberDebunk exists, and the principles we measure ourselves against.

Security is a language problem

Most teams don't ship insecure code because they don't care. They ship it because the tools meant to protect them speak a language no-one in the room reads. We translate.

Plain English beats more dashboards

A scanner that explains what's broken, why a real attacker would care, and exactly what to change is more useful than a wall of red numbers. Every alert ships with a fix, or it doesn't ship.

Compliance should be a side-effect

The GDPR Companion exists because European teams shouldn't have to choose between shipping fast and answering an auditor. Article 32 in plain language, mapped to your actual codebase.

European by default, not by toggle

Customer data lives in Frankfurt and Amsterdam. Our DPO is on staff, not on retainer. SOC 2 Type II is underway; the privacy policy describes current status and how to request details.

Boring is a feature

No surprise pricing. No phantom seats. No legal threats over screenshots. Predictable software run by predictable humans, built to still work the same way next year.

How we work

Translate, don't transcribe

Anyone can paste a CVE description. We add the context, "this matters because your customer-data API uses it", or we keep our mouths shut.

Not this: "CVE-2024-44188, heap buffer overflow in libxml2."

Less FUD, more fixed

Every alert ships with a fix. Every dashboard ships with a recommended next action. If we can't tell you what to do, we don't tell you to panic.

Not this: "🚨 ATTACKERS CAN EXPLOIT THIS, UPGRADE NOW!!!"

Made in Europe, GDPR first

Customer data lives in Frankfurt. Our DPO is on staff, not on retainer. The GDPR Companion exists because we already had to build it for ourselves.

Not this: "Choose your data region in your account settings."

A Companion that says "I don't know"

Our Companion is scoped, retrieval-grounded, and will refuse to answer rather than invent a CVE. We'd rather be useful 80% of the time than confident 100% of the time.

Not this: "Sure! Here's a fictional CVE-2099-31337…"

Open in the boring places

We open-source our scanner core, our SBOM tooling, and our test fixtures. We close-source the parts where customers pay us, and we say so out loud.

Not this: "Source-available with a 47-clause non-compete."

Boring is a feature

No surprise pricing. No phantom seats. No legal threats over screenshots. Predictable software run by predictable humans, that's the whole pitch.

Not this: "Limited-time 73% off if you upgrade to our Vortex Tier."

Want to help build this?

Engineering, security research, content, and operations roles — we hire in Berlin or remote across CET ±2.

Cybersecurity, in plain English.

The industry talks to itself. We talk to the rest of you.

What we believe

Security is a language problem

Plain English beats more dashboards

Compliance should be a side-effect

European by default, not by toggle

Boring is a feature

How we work

Translate, don't transcribe

Less FUD, more fixed

Made in Europe, GDPR first

A Companion that says "I don't know"

Open in the boring places

Boring is a feature

Want to help build this?

Try it on your own repo. We'll wait.