Available
Automated scanning
Phylex Scan
Scheduled security scanning for the websites and APIs you own: OWASP Top 10, TLS, email-domain security, ports, and actively exploited CVEs, with audit-ready reports.
- Free 7-day trial
- From IDR 490k/month
Phylex · by Phoenix Stratos Secura
Test, monitor, and prove the security of your systems from one console.
Phylex brings together automated scanning, attack-surface monitoring, PDP Law readiness, and expert penetration testing. Every finding, fix, and report is managed in Phylex Console.
- Registered private Electronic System Operator (Komdigi)
- Data stored in Google Cloud's Jakarta region
- Only assets you own: ownership verified before testing
Phylex products
Start with what you need most. Every product uses the same account and console.
Limited trial
Continuous monitoring
Phylex Watch
Daily attack-surface monitoring: new subdomains and takeover risk, injected online-gambling spam and defacement, risky ports, lookalike domains, and stolen accounts.
- EASM per domain
- Email alerts
Available
Regulatory compliance
Phylex Comply
Readiness for Indonesia's PDP Law and GR 33/2026 before 16 January 2027. Start now with our guided PDP Readiness Check.
- PDP Readiness Check
- Workspace (soon)
Service
Tested by experts
Phylex Pentest
Manual penetration testing for web, API, mobile, and cloud, with findings mapped to ISO/IEC 27001 controls. Includes Phylex VIP (Mobile Pentest) for executives' phones.
- One-off · Retest · Annual
- VIP (Mobile Pentest)
Service
Tested by experts
Phylex IoT Lab
Testing for connected devices (firmware, debug ports, OTA updates, and radio) with an ETSI EN 303 645 readiness report.
- FOINIKS hardware lab
Coming soon
Internal networks & branches
Phylex Probe
Test internal networks and offline systems from the inside, as an agent on your server or a plug-in device for branches.
- Virtual · Box
One console for every product
Your team signs in once. The products your organization has appear as tabs at the top.
Ownership verification
DNS TXT, a file, or an RoE document. Phylex never tests assets that are not yours.
Projects
Group assets by application, brand, or client, then filter scans, findings, and monitoring per project.
Findings & triage
Permanent finding numbers, triage notes for audits, and automatic closing once fixed.
Reports
PDF for management and auditors, CSV, Markdown, and JSON, mapped to CWE, OWASP, and ISO/IEC 27001.
Phylex Assistant (AI)
Plain-language explanations of findings and how-to answers, with data masked before it reaches the model.
Team & billing
Invite members, set roles, and pay by bank transfer, with tax invoices.
Common questions
Which product should I start with?
If you have a website or API, start with Phylex Scan (free 7-day trial). If you have many domains or have been hit by online-gambling spam, add Phylex Watch. For PDP Law obligations, choose the PDP Readiness Check from Phylex Comply. For an in-depth test report for an audit or tender, choose Phylex Pentest.
Do all products use the same account?
Yes. One account and one organization in Phylex Console. Products your organization has appear as tabs, and the organization owner can request others from the Other products menu.
Where is my data stored?
In Google Cloud's Jakarta region (asia-southeast2). Supporting services outside Indonesia (sign-in, email, and the AI Assistant with masked data) are listed in the Privacy Policy.
How does Phylex make sure only my assets are tested?
Every asset and domain must be verified (DNS TXT, a file, or a signed RoE document) before testing, and DNS or file proof is re-checked before every scan.
Start with one domain today
Try Phylex Scan free for 7 days, or tell our team what you need.