SYBA Cybersecurity Agent

SYBA Shield is the cyber-concierge for your browser. It works the moment you install it, with no sign-up, no account and no API key. The core checks run on your own device. Every page you visit gets a green, amber or red shield in your toolbar, from checks that run on your device: 1. URL heuristics: lookalike domains (paypal-secure-login.com), IDN homograph attacks (аpple.com with a Cyrillic а), suspicious TLDs, IP-literal hosts, embedded credentials and other fast offline signals. 2. Page signals: password fields on plain HTTP, login forms posting to a different domain, login pages themed for one brand but hosted on another, hidden iframes sized for clickjacking. 3. Bundled blocklist: a list of known-malicious domains, enforced locally by the browser with no network call. Data sources for the bundled lists: - Phishing data from PhishTank (phishtank.org), operated by Cisco Talos. - Phishing.Database by Mitchell Krog, Nissar Chababy and contributors, MIT licence. - Phishing-kit indicators from phish.report/IOK, Open Database License (ODbL 1.0). A Syba Insurance account is optional. If you sign in, it adds: • AI page scan: SYBA Shield captures the visible tab and asks a multimodal AI model whether the page is phishing. It catches fake browser warnings, fake MFA prompts, lookalike logos and "your account is locked" pressure tactics. It runs when you click "Scan now", and, while you are signed in, automatically on a page that already shows a phishing signal (a medium- or high-severity URL or page finding). SYBA does not capture a page on its own when it is on SYBA's curated safe list. Turn off "Vision scan" in settings and SYBA never captures a page on its own. • Live protection (the "Live protection from SYBA" switch): extra checks on SYBA's servers for email links and for page scans (see Data practices). On by default for company seats, and for a personal account that has turned on AI cloud scanning; otherwise off for personal accounts until you switch it on. • Safety chat agent: a side-panel co-pilot that answers questions about the page you are on. • Site report: while the side panel is open, a short security report for the site you are viewing. The toolbar shield, the on-device heuristics, the page signals and the local blocklist keep working whether or not you sign in. Warnings and email: • Phishing warning: when a page is flagged, SYBA shows a clear, dismissible banner with the exact reasons and a one-click "trust this site" for a false alarm. By default SYBA does not block the page; you stay in control. Two stricter modes are optional in settings: a full-screen warning wall, or a strict mode that replaces the page. • Email guard: on Gmail and Outlook web only, SYBA checks the email you open for the classic tells: link text showing one domain while the link goes to another, lookalike link domains, sender names impersonating a brand the sender's address does not own, and stacked urgency language. Findings appear as a banner in the email. These checks run on your device. With Live protection on, the links in the opened email and the sender's domain are also checked on SYBA's servers. A separate AI email scan, behind a consent toggle that is OFF by default, sends the opened email's content for AI classification. • Persistent chat: your conversation with the safety agent is stored locally and survives closing the panel. What you can adjust: • Protection on/off (master switch) • Phishing warning style (banner, warning wall, or strict full page) • Email guard on/off • Vision scan on/off • Notifications on phishing only, or also on suspicious • Sensitivity (Paranoid / Balanced / Lenient) • Your own OpenRouter key and model, if you prefer to scan without a SYBA account • Per-site trust and block list What we never do: • Show you ads, or sell or share your data for advertising. • Capture a page on a schedule when there is no phishing signal on it. • Keep server-side copies of screenshots or email content after the verdict returns. Made by Syba Insurance, the cyber concierge for the AI era.