If you are evaluating continuous offensive security platforms in 2026, two names will probably surface alongside each other: Bishop Fox Cosmos, the enterprise-scale managed service from a 20-year offensive security firm, and Lorikeet Security PTaaS, the modern transparently-priced platform built for growth-stage SaaS, AI, fintech, and healthcare companies. Both deliver continuous testing. Both pair human pentesters with platform automation. Both have continuous-pentest workflows. They are also built for materially different buyers, and the right answer to "which one" depends almost entirely on which buyer you are.
This is an honest side-by-side comparison across 11 axes. We are obviously not neutral — this is published on the Lorikeet Security site — but we have tried to write this as if a sophisticated procurement team is reading it. Where Bishop Fox wins, we say so. Where the right answer depends on your stage and budget, we say so. The point is to give you a fair structure for your evaluation, not to convince you that one product is universally better.
Quick orientation: Bishop Fox Cosmos is the right choice if you are an Equifax / Zoom / John Deere-scale enterprise with an existing internal red team and a procurement process that expects quote-only enterprise software. Lorikeet Security PTaaS is the right choice if you are a SaaS / AI / fintech / healthcare growth-stage company that wants modern PTaaS workflow ergonomics, transparent pricing, white-glove human access, and continuous testing aligned to KEV-listed CVEs in your stack.
What Each Platform Actually Is
Bishop Fox Cosmos
Cosmos is Bishop Fox's managed continuous offensive security platform. It launched in February 2020 as CAST (Continuous Attack Surface Testing) and was rebranded to Cosmos. On February 10, 2026, Bishop Fox layered in Cosmos AI, a proprietary AI engine for AI-augmented application penetration testing.
Bishop Fox positions Cosmos as "a fully managed service for continuous threat exposure management" combining attack surface management technology with expert-driven testing. The customer does not deploy or maintain anything — Bishop Fox runs the platform and the humans behind it as a service. Today the offering covers three managed service lines under one roof: Cosmos Attack Surface Management (CASM), Cosmos Application Penetration Testing (now AI-augmented via Cosmos AI), and Cosmos External Penetration Testing. The platform pitch is "evidence-first": Bishop Fox continuously discovers assets, fingerprints and screenshots them, and routes plausibly exploitable findings into a human validation pipeline so that "no unvalidated findings are ever delivered to the customer."
Bishop Fox the firm was founded in 2005, has approximately 380 employees, ~$73.5M in annual revenue, and has raised approximately $158M total — including a $75M Series B led by Carrick Capital Partners in July 2022. Cosmos has been recognized as a Leader in the GigaOm Attack Surface Management Radar across multiple years. Named customers include Zoom, Equifax, Republic Services, John Deere, and Agora.
Lorikeet Security PTaaS
Lorikeet Security was founded in 2021 and has completed 370+ offensive security engagements across enterprise organizations, VC-backed tech leaders, AI infrastructure companies, fintech, healthcare, and public sector clients. The PTaaS platform is the company's primary delivery vehicle for continuous offensive security: a modern real-time portal with live findings, direct chat with senior testing teams, attack surface management, integrated reporting, and KEV-matched re-testing triggered immediately when new exploits emerge.
Bundled with the platform is Lory AI Pentester, an autonomous AI-driven penetration testing engine. Unlike surface scanners, Lory executes deep prompt-to-pentest engagements: discovering live assets, mapping multi-step exploit chains, verifying vulnerabilities with reproducible cURL Proof-of-Concept (PoC) commands, parsing OpenAPI/Swagger schemas and GitHub repositories, and automatically generating code-level remediation diffs. Testing covers web applications, complex API ecosystems (REST, GraphQL, gRPC), cloud infrastructure (AWS, Azure, GCP), Active Directory / enterprise networks, mobile apps, and source code review — blending autonomous AI velocity with manual, senior offensive security engineering.
Pricing is transparently published on the site. Web app pentests start at $7,500. Continuous offerings are scoped per-engagement with clear line items rather than opaque, quote-only enterprise contracts. Lorikeet Security targets SaaS, AI companies, healthcare, fintech, and government. Recent published work includes a case study with Flowtriq showing the AI-audit-plus-manual-pentest model, a gap analysis of 8 major 2025-2026 breaches through the continuous-pentesting lens, and zero-day research across open-source enterprise software. The positioning is high-velocity, white-glove offensive testing built for the AI-native era of software development.
The Quick Comparison
| Axis | Lorikeet Security PTaaS | Bishop Fox Cosmos |
|---|---|---|
| Pricing model | Published — web app pentest from $7,500, all line items on site | Quote-only, no public starting ACV |
| Target buyer | SaaS, AI, fintech, healthcare, gov — growth-stage to mid-market | Fortune 500 / large enterprise (Equifax, Zoom, John Deere) |
| Brand pedigree | Founded 2021, 370+ completed engagements across enterprise, SaaS, fintech & AI | Founded 2005, ~380 employees, $73.5M revenue |
| ASM & autonomous testing | Lory AI Pentester bundled with PTaaS — prompt-to-pentest, cURL PoCs, automated code fixes | Bundled with Cosmos, "17,000+ data points and 110B+ automations" |
| Human-in-loop access | Real-time chat in portal directly with assigned senior pentesters | Shared Slack channel with the Bishop Fox testing team |
| AI augmentation | Autonomous Lory AI Pentester + Anthropic Claude API enrichment in findings workflow | Cosmos AI proprietary engine (launched Feb 10, 2026) |
| Time-to-finding | Instant autonomous probing + KEV-matched re-testing in hours | "Hours to days" initial findings, 5 business days final (Cosmos AI) |
| Reporting style | Live portal as primary deliverable, plus integrated PDF | Executive-grade PDF reporting, well-reviewed |
| Integrations | Portal-first, GitHub, Jira, Slack, Vanta MSP | Jira, ServiceNow, Slack, AWS Marketplace listing |
| Continuous re-test economics | Free retesting included in engagement scope | Continuous managed service model; re-tests included |
| Procurement path | Direct, transparent pricing, no procurement gate | AWS Marketplace + private offer / direct sales |
The rest of this post walks through each axis in detail. We have grouped the 11 axes into three buckets: where Lorikeet Security wins, where Bishop Fox wins, and where the answer is "depends on your stage."
Where Lorikeet Security Wins
Pricing transparency
Lorikeet Security publishes pricing on the website. Web application pentests start at $7,500. Continuous offerings have transparent line items. You can do back-of-envelope budgeting before the first sales call. Bishop Fox is quote-only on its site, on AWS Marketplace ("Custom pricing options"), and in any published material we could find. Given Cosmos's named customer base and the "thousands of domains" scale described in their case studies, the implied ACV is six figures and up — but Bishop Fox does not say so publicly.
This is a real, defensible Lorikeet Security win. It is also worth being honest that enterprise procurement teams often expect quote-only software — published pricing is a feature for some buyers and an irrelevant footnote for others.
Workflow ergonomics for human-in-loop access
Both platforms put real humans in front of the customer. The differentiator is workflow. Lorikeet Security's portal includes real-time chat with the named pentester actively working your engagement — questions, scope clarifications, and finding context all happen inside the same interface where the findings live. Bishop Fox provides a dedicated Slack channel with the Cosmos testing team, which is excellent if your team already lives in Slack and prefers to keep security work there.
The honest read: portal-first vs. chat-tool-first is a workflow preference, not a quality difference. Lorikeet Security's bet is that consolidating the conversation, the findings, and the asset inventory into one interface reduces context-switching for the customer's security team. Bishop Fox's bet is that meeting customers in Slack is friction-free for the buyer.
Procurement path and time-to-start
Lorikeet Security's direct-sales motion with published pricing means a typical small or mid-market buyer can scope, contract, and start a pentest in days. Bishop Fox's enterprise sales process — quote, contract, AWS Marketplace private offer or direct procurement, then onboarding — is appropriate for a Fortune 500 buyer but is heavier than a growth-stage company typically wants for a quarterly engagement.
Where Bishop Fox Wins
Brand pedigree and track record
Bishop Fox has 20 years of brand depth in offensive security, ~380 employees, ~$73.5M in annual revenue, $75M from Carrick Capital Partners in their Series B, and a marquee customer list that includes Zoom, Equifax, Republic Services, John Deere, and Agora. They have been a GigaOm ASM Leader across multiple years.
Lorikeet Security was founded in 2021 and has completed 370+ offensive security engagements spanning enterprise clients, VC-backed tech leaders, AI infrastructure firms, healthcare networks, and fintech platforms. While Bishop Fox holds the institutional longevity and legacy headcount, Lorikeet's 370+ engagements represent a modern, battle-tested track record across cutting-edge architectures: cloud-native microservices, LLM/agentic pipelines, complex API ecosystems, and rapid-shipping CI/CD workflows.
If your procurement strictly requires Fortune 500 institutional brand references and a 20-year incumbent name, Bishop Fox is the answer. However, Lorikeet Security is far from an unproven boutique; with 370+ completed projects, Lorikeet delivers the battle-tested rigor of a mature offensive security firm combined with the speed, technical agility, and dedicated senior attention that large consulting firms struggle to deliver outside their top-paying flagship accounts.
Reporting polish for traditional executive deliverables
Bishop Fox is repeatedly praised across third-party reviews for the quality of its executive-facing reporting — the kind of polished PDF that lands well in a board pack. Lorikeet Security's primary deliverable is the live portal, with PDF reporting integrated for audit and customer-facing use cases. Both are professional-grade, but if your buyer's primary consumption pattern is a PDF dropped into a SOC 2 evidence folder or attached to a board email, Bishop Fox has the heritage edge here.
That said, Lorikeet Security's bet is the opposite — that the live portal is a more useful primary deliverable than a PDF for a security team that works findings continuously rather than annually. The right answer depends on whether your remediation workflow is "open the report, work the findings" or "log into the platform, work the findings."
Scale demonstrated against very-large-enterprise attack surfaces
Bishop Fox has publicly demonstrated Cosmos against attack surfaces of 500,000+ targets (Zoom, when they signed in 2020) and the multi-thousand-domain Equifax footprint across 25 countries with 11,000+ employees. If your environment looks more like Equifax than like a modern cloud-first tech company, Bishop Fox has documented experience at that conglomerate scale.
Lorikeet Security, across its 370+ completed engagements, has proven scale across complex multi-cloud environments (AWS, GCP, Azure), sprawling modern API gateways, distributed SaaS footprints, and high-security fintech/healthcare infrastructures. While Lorikeet is intentionally scoped around modern attack surfaces rather than scanning legacy global conglomerate network blocks, its autonomous platform and PTaaS engine handle high-volume, multi-asset continuous testing without missing a beat.
Where The Answer Depends On Your Stage
Continuous testing depth & autonomous verification
Bishop Fox ships attack surface management integrated with continuous testing, citing "17,000+ data points and 110+ billion automations" with connectors for AWS, GCP, Azure, Cloudflare, and Oracle. Findings are routed to internal operators for validation.
Lorikeet Security integrates Lory AI Pentester directly with its PTaaS platform, delivering autonomous prompt-to-pentest capabilities across declared in-scope assets. Lory actively probes targets, maps attack vectors, verifies vulnerabilities with reproducible cURL Proof-of-Concept commands, parses OpenAPI/Swagger schemas and repositories, and automatically generates code-level remediation diffs. Backed by real-world methodologies proven across 370+ engagements and validated by senior human pentesters, Lorikeet's continuous testing produces zero noise and directly actionable engineering fixes.
AI augmentation philosophy
Bishop Fox launched Cosmos AI on February 10, 2026 as an internal tester augmentation engine, designed to accelerate Bishop Fox operators with the explicit positioning that "no unvalidated findings are ever delivered to the customer."
Lorikeet Security takes a two-pronged approach with AI: customer-accessible autonomous pentesting via Lory AI Pentester (which autonomously discovers vulnerabilities, validates exploits with cURL PoCs, and generates automated code fixes), paired with Anthropic Claude API integration in the reporting and findings workflow for senior human pentesters. Both platforms use AI to dramatically compress testing timelines and eliminate routine friction. Bishop Fox keeps AI strictly as an internal tooling layer for its analysts, while Lorikeet puts autonomous AI pentesting, verified PoCs, and real-time remediation directly into the hands of customers alongside human offensive validation.
Time-to-finding
Bishop Fox's Cosmos AI claims "hours to days" for initial validated findings and within five business days for final results — a real, specific commitment that is well above legacy pentest cadences. Lorikeet Security's continuous PTaaS model delivers immediate visibility: Lory AI Pentester begins probing and validating vulnerabilities within minutes of onboarding, providing instant cURL PoCs and findings in the live portal, while senior human pentesters dive deep into business logic and high-severity chaining. When a critical CVE drops on CISA KEV or in your stack, re-testing occurs within hours.
Continuous re-test economics
Lorikeet Security includes free retesting in the engagement scope — once you remediate, we verify your fix at no additional cost. Bishop Fox's continuous managed-service model includes re-tests as part of the year-round engagement. Both vendors have moved past the legacy "retest is a separate engagement" pattern that enterprise pentest firms used in the 2010s. The economics question is more about total contract value: at growth-stage scale Lorikeet Security's published pricing makes the math obvious; at Equifax scale Bishop Fox's quote-only model is sized to the engagement complexity.
Buyer fit (the most important axis)
This is the axis that determines almost every other answer in this comparison. Bishop Fox Cosmos is built for Fortune 500 / large-enterprise buyers with internal red teams that want a "second set of eyes" (Equifax's words) operating continuously, with the procurement infrastructure to handle quote-only enterprise contracts, and with attack surfaces measured in thousands of domains. Lorikeet Security PTaaS is built for SaaS, AI, fintech, healthcare, and growth-to-mid-market enterprises that need offensive testing aligned to enterprise compliance requirements (SOC 2, ISO 27001, HIPAA, PCI-DSS, FedRAMP), want modern workflow ergonomics, value pricing transparency, and need to start engagements without a months-long procurement cycle.
Cosmos is overkill (and likely cost-prohibitive) for a Series A SaaS or agile engineering team. Lorikeet Security is purposely not positioned for the Equifax-scale legacy roster. This is not a competition between products that should win every deal — it is two vendors built deliberately for different buyers.
The Honest Summary
If you're an enterprise buyer with internal red team, multi-thousand-domain attack surface, and procurement that runs on quote-only enterprise contracts: Bishop Fox Cosmos is the right answer. We do not pretend otherwise.
If you're a SaaS, AI, fintech, or healthcare growth-stage company that values pricing transparency, modern PTaaS workflow ergonomics, white-glove human access through a portal, and continuous testing aligned to KEV-listed CVEs in your stack: Lorikeet Security PTaaS is built for you. That's our buyer profile, and we are deliberately good at it.
The wrong way to read this comparison is as a winner-take-all evaluation. The right way to read it is as a sorting function for which buyer you actually are. Both products are real, both are well-built, both have human pentesters and continuous platforms behind them. Pick the one that fits your stage.
Want to See What Lorikeet Security PTaaS Looks Like Against Your Attack Surface?
Book a scoping call — we will walk through what continuous testing of your specific environment would surface, what the engagement structure looks like, and what it costs (with transparent line items, not a quote-only number you have to ask for). If Bishop Fox Cosmos is genuinely the better fit for your stage, we will tell you that too.
