Cyren Support

Check Cyren service status, obtain product support, and read frequently asked questions.

Cyren service status

Status loading...

Status information...

View Details

Product support tools

MX Lookup

Determine if your domain is using Cyren Email Security.

MX Lookup

Report AV Misclassification

Please report any AV false positives and false negatives. Cyren will investigate your report within 72 hours upon delivery.

Open Request

Cyren security center tools

Check IP Reputation

Check the reputation of IP addresses – and report and request to release mistakenly blocked IP addresses.

Check IP Reputation

Check URL Category

View current URL classifications – and request URL classification changes.

Check URL Category

Classic product support


Please visit our eXpurgate support page for contact information and frequently asked questions.

Support page

Frequently asked questions

Email security

  • Does Cyren block phishing emails or URLs used to test and train users?   

    Effective test and training phishing emails and any associated phishing URLs exhibit the characteristics of real phishing attacks. Due to this similarity, the standard practice in the security industry is to detect and classify these emails and URLs as phishing. Cyren follows this standard industry practice and our automated detection systems will block test phishing emails and URLs as they would for malicious phishing, unless the email administrator has configured a whitelist entry to allow them. Most phishing security awareness training vendors provide orientation on whitelisting best practices to ensure that their test and training emails are delivered to mailboxes.

  • How is Cyren anti-spam implemented?   

    Anti-Spam is integrated into a service provider environment or a vendor device such as a Mail Gateway. It consists of an engine that resides in the partner product or environment and detection services via the GlobalView Cloud.

  • What is Cyren’s spam detection rate?   

    Due to its patented Recurrent Pattern Detection™ (RPD™) technology, Cyren Anti-Spam has a typical sustained detection rate of more than 99%, with virtually zero false-positives (approximately 1 in 1.5 million).

  • What algorithms does Cyren use to block spam?   

    Cyren Anti-Spam uses our RPD technology, which differs from traditional filters. RPD extracts and analyzes relevant message patterns, classifying both distribution patterns and structure patterns, regardless of the content or language of the message.

  • What is Cyren’s approach to image spam?   

    Cyren RPD contains an intrinsic mechanism to match recurring patterns across similar messages. In the case of images, Cyren Anti-Spam is able to match images even with minute differences inserted by spammers.

  • How do you investigate and study false negative and false positive mail to improve your anti-spam engine?   

    Cyren offers a tool to report false negatives (FN) or false positive (FP) detections. A team of analysts reviews each FP and adjusts algorithms to avoid recurrences. An automated process analyzes FNs and adds these to RPD, to improve future queries.

  • How long does it take to detect a new spam attack, and how long does it take for this information to be available to partners systems?   

    We analyze billions of emails per day, enabling detection of new spam in seconds. Our “GlobalView Cloud delivers the information to partners the moment a new attack is detected. From the partner’s perspective, all this takes only a few seconds.


  • How long has the company been around and involved in the AV Industry?   

    We have been in this business since the very first days viruses appeared on micro-computers, now referred to as PCs. We have been processing virus samples since about 1988.

  • What is special about Cyrens vs. other AV SDKs?   

    Award-winning, multi-layered detection – The SDK is based on a unified platform with multiple detection technologies for maximum protection. Zero-hour detection is ensured by the flexible architecture that enables fast reaction to new threat types. Cyren AV continually proves its superior detection in product evaluations. For this reason it has been selected by industry leaders, such as Google, Websense and Microsoft.

    Industry leading performance & scalability – The SDK excels at rapid object processing (particularly clean files which are the majority on most systems) and consumes very low resources. The Cyren engine has numerous proven deployments requiring less than half the servers compared to other solutions. This advantage is especially clear on sites where Cyren runs alongside a second AV engine. A complete evaluation of Cyren’s AV benefits from integration of the SDK into the OEM environment to illustrate this large resource saving.

    Maximum operational flexibility – The SDK is easily integrated as a standalone AV or with multiple engines. Additionally the tiny SDK footprint supports deployment on a wide range of platforms and environments. These advantages have convinced vendors such as McAfee to deploy Cyren alongside their own solutions. The flexibility of implementation has made Cyren the choice for a wide range of solutions, from the smallest network appliances and desktop clients to carrier-grade network clouds.

  • How do you name malware?   

    As far as naming is concerned we try to be as close as possible to the CARO naming convention. We may append the name of the heuristic detection mini-engine. Therefore the name could be CARO_name!generic or CARO_name!heuristic_mini-engine.

  • The Cyren solutions we know are all based in the cloud. Is antivirus a cloud-based solution?   

    Most virus detections are handled by the SDK, which resides locally on the server or device. The SDK utilizes multiple engines to detect viruses based on heuristics, file signatures and other proprietary techniques. However, in some cases the SDK will query the cloud for final verification.

  • Can you describe the API?   

    The AV API is similar to Common Object Model (COM). It consists of fewer than ten calls with a range of parameters for optimal flexibility.

  • What environment can the SDK be integrated into?   

    The AV SDK can be integrated with any language that provides a C/C++ interface method, such as Python, Java, etc.

  • How long does the integration typically take?   

    The AV SDK is very easy to integrate. Most partners take one to three days to integrate the SDK.

  • Does the Cyren AV SDK scan compressed archives e.g.: zip files?   

    Yes. The SDK scans zip files by default and the level of depth can be specified, such as a zip within a zip, within a zip, etc. The default scan level is 5.

  • When scanning an archive does the SDK report on every file within the archive, or just a general answer if a virus was found in one of the files?   

    The scan engine will iterate and scan through all objects inside an archive.

  • How big is your database/definition file?   

    The definition files are between 70 MB to about 120 MB.

  • Can you supply some virus files for evaluation of your SDK?   

    We never supply actual viruses for test. It is against the CARO (Computer AntiVirus Researcher’s Organization) rules. We can supply specific test samples that are not actual viruses but trigger our engine. The EICAR test file can also be downloaded from This can be used to test different functionalities in the SDK.

Contact Cyren support


US (toll free): 1-888-512-4544
US: 1-650-864-2090
UK: +44 800-048-8166
Germany: +49 30 52 00 56 130
Israel: +972 9-863-6888

Support hours:
Monday through Friday
9 AM - 6 PM
(Local business hours)


Send us a note and a Cyren Support team member will help you get back up to speed.

Contact Support