If you are evaluating continuous offensive security platforms in 2026, two names will probably surface alongside each other: Bishop Fox Cosmos, the enterprise-scale managed service from a 20-year offensive security firm, and Lorikeet Security PTaaS, the modern transparently-priced platform built for growth-stage SaaS, AI, fintech, and healthcare companies. Both deliver continuous testing. Both pair human pentesters with platform automation. Both have ASM and continuous-pentest workflows. They are also built for materially different buyers, and the right answer to "which one" depends almost entirely on which buyer you are.
This is an honest side-by-side comparison across 11 axes. We are obviously not neutral — this is published on the Lorikeet site — but we have tried to write this as if a sophisticated procurement team is reading it. Where Bishop Fox wins, we say so. Where the right answer depends on your stage and budget, we say so. The point is to give you a fair structure for your evaluation, not to convince you that one product is universally better.
Quick orientation: Bishop Fox Cosmos is the right choice if you are an Equifax / Zoom / John Deere-scale enterprise with an existing internal red team and a procurement process that expects quote-only enterprise software. Lorikeet PTaaS is the right choice if you are a SaaS / AI / fintech / healthcare growth-stage company that wants modern PTaaS workflow ergonomics, transparent pricing, white-glove human access, and continuous testing aligned to KEV-listed CVEs in your stack.
What Each Platform Actually Is
Bishop Fox Cosmos
Cosmos is Bishop Fox's managed continuous offensive security platform. It launched in February 2020 as CAST (Continuous Attack Surface Testing) and was rebranded to Cosmos. On February 10, 2026, Bishop Fox layered in Cosmos AI, a proprietary AI engine for AI-augmented application penetration testing.
Bishop Fox positions Cosmos as "a fully managed service for continuous threat exposure management" combining attack surface management technology with expert-driven testing. The customer does not deploy or maintain anything — Bishop Fox runs the platform and the humans behind it as a service. Today the offering covers three managed service lines under one roof: Cosmos Attack Surface Management (CASM), Cosmos Application Penetration Testing (now AI-augmented via Cosmos AI), and Cosmos External Penetration Testing. The platform pitch is "evidence-first": Bishop Fox continuously discovers assets, fingerprints and screenshots them, and routes plausibly exploitable findings into a human validation pipeline so that "no unvalidated findings are ever delivered to the customer."
Bishop Fox the firm was founded in 2005, has approximately 380 employees, ~$73.5M in annual revenue, and has raised approximately $158M total — including a $75M Series B led by Carrick Capital Partners in July 2022. Cosmos has been recognized as a Leader in the GigaOm Attack Surface Management Radar across multiple years. Named customers include Zoom, Equifax, Republic Services, John Deere, and Agora.
Lorikeet Security PTaaS
Lorikeet was founded in 2021 and has completed approximately 170 engagements. The PTaaS platform is the company's primary delivery vehicle for continuous offensive security: a modern portal with live findings, real-time chat with the testing team, asset management, integrated reporting, and KEV-matched re-testing on triggers rather than on a fixed annual calendar. ASM is bundled with the platform. Pentesting covers web app, API, network, mobile, cloud, and code review, all delivered through manual human pentesters with AI-assisted enrichment in the findings workflow (Anthropic API integration).
Pricing is published on the site. Web app pentests start at $7,500. Continuous offerings are scoped per-engagement with transparent line items rather than quote-only enterprise contracts. Lorikeet targets SaaS, AI companies, healthcare, fintech, and government. Recent published work includes a case study with Flowtriq showing the AI-audit-plus-manual-pentest model and a gap analysis of 8 major 2025-2026 breaches through the continuous-pentesting lens. The positioning is white-glove offensive testing built for the AI-native era of software development.
The Quick Comparison
| Axis | Lorikeet PTaaS | Bishop Fox Cosmos |
|---|---|---|
| Pricing model | Published — web app pentest from $7,500, all line items on site | Quote-only, no public starting ACV |
| Target buyer | SaaS, AI, fintech, healthcare, gov — growth-stage to mid-market | Fortune 500 / large enterprise (Equifax, Zoom, John Deere) |
| Brand pedigree | Founded 2021, ~170 engagements | Founded 2005, ~380 employees, $73.5M revenue |
| ASM integration | Bundled with PTaaS, feeds pentest workflow continuously | Bundled with Cosmos, "17,000+ data points and 110B+ automations" |
| Human-in-loop access | Real-time chat in portal with named pentesters | Shared Slack channel with the Bishop Fox testing team |
| AI augmentation | Anthropic API enrichment in findings workflow | Cosmos AI proprietary engine (launched Feb 10, 2026) |
| Time-to-finding | KEV-matched re-testing in hours; continuous workflow | "Hours to days" initial findings, 5 business days final (Cosmos AI) |
| Reporting style | Live portal as primary deliverable, plus integrated PDF | Executive-grade PDF reporting, well-reviewed |
| Integrations | Portal-first, GitHub, Jira, Slack, Vanta MSP | Jira, ServiceNow, Slack, AWS Marketplace listing |
| Continuous re-test economics | Free retesting included in engagement scope | Continuous managed service model; re-tests included |
| Procurement path | Direct, transparent pricing, no procurement gate | AWS Marketplace + private offer / direct sales |
The rest of this post walks through each axis in detail. We have grouped the 11 axes into three buckets: where Lorikeet wins, where Bishop Fox wins, and where the answer is "depends on your stage."
Where Lorikeet Wins
Pricing transparency
Lorikeet publishes pricing on the website. Web application pentests start at $7,500. Continuous offerings have transparent line items. You can do back-of-envelope budgeting before the first sales call. Bishop Fox is quote-only on its site, on AWS Marketplace ("Custom pricing options"), and in any published material we could find. Given Cosmos's named customer base and the "thousands of domains" scale described in their case studies, the implied ACV is six figures and up — but Bishop Fox does not say so publicly.
This is a real, defensible Lorikeet win. It is also worth being honest that enterprise procurement teams often expect quote-only software — published pricing is a feature for some buyers and an irrelevant footnote for others.
Workflow ergonomics for human-in-loop access
Both platforms put real humans in front of the customer. The differentiator is workflow. Lorikeet's portal includes real-time chat with the named pentester actively working your engagement — questions, scope clarifications, and finding context all happen inside the same interface where the findings live. Bishop Fox provides a dedicated Slack channel with the Cosmos testing team, which is excellent if your team already lives in Slack and prefers to keep security work there.
The honest read: portal-first vs. chat-tool-first is a workflow preference, not a quality difference. Lorikeet's bet is that consolidating the conversation, the findings, and the asset inventory into one interface reduces context-switching for the customer's security team. Bishop Fox's bet is that meeting customers in Slack is friction-free for the buyer.
Procurement path and time-to-start
Lorikeet's direct-sales motion with published pricing means a typical small or mid-market buyer can scope, contract, and start a pentest in days. Bishop Fox's enterprise sales process — quote, contract, AWS Marketplace private offer or direct procurement, then onboarding — is appropriate for a Fortune 500 buyer but is heavier than a growth-stage company typically wants for a quarterly engagement.
Where Bishop Fox Wins
Brand pedigree and enterprise reference customers
Bishop Fox has 20 years of brand depth in offensive security, ~380 employees, ~$73.5M in annual revenue, $75M from Carrick Capital Partners in their Series B, and a customer list that includes Zoom, Equifax, Republic Services, John Deere, and Agora. They have been a GigaOm ASM Leader across multiple years. Lorikeet is a 2021-founded firm with approximately 170 engagements completed.
This is not a contest where Lorikeet is going to claim a win. If your procurement requires Fortune 500 reference customers and a 20-year incumbent name, Bishop Fox is the answer. The right way to frame Lorikeet against this axis is "boutique speed and modern workflow vs. heritage scale" — not "we have more brand than them," because we don't.
Reporting polish for traditional executive deliverables
Bishop Fox is repeatedly praised across third-party reviews for the quality of its executive-facing reporting — the kind of polished PDF that lands well in a board pack. Lorikeet's primary deliverable is the live portal, with PDF reporting integrated for audit and customer-facing use cases. Both are professional-grade, but if your buyer's primary consumption pattern is a PDF dropped into a SOC 2 evidence folder or attached to a board email, Bishop Fox has the heritage edge here.
That said, Lorikeet's bet is the opposite — that the live portal is a more useful primary deliverable than a PDF for a security team that works findings continuously rather than annually. The right answer depends on whether your remediation workflow is "open the report, work the findings" or "log into the platform, work the findings."
Scale demonstrated against very-large-enterprise attack surfaces
Bishop Fox has publicly demonstrated Cosmos against attack surfaces of 500,000+ targets (Zoom, when they signed in 2020) and the multi-thousand-domain Equifax footprint across 25 countries with 11,000+ employees. If your environment looks more like Equifax than like a 50-person Series B SaaS, Bishop Fox has documented experience at that scale and Lorikeet does not.
Where The Answer Depends On Your Stage
ASM integration depth
Both platforms ship attack surface management integrated with continuous testing. Bishop Fox cites "17,000+ data points and 110+ billion automations" behind the platform, with cloud connectors for AWS, GCP, Azure, Cloudflare, and Oracle. Lorikeet's ASM is also continuously running and feeds the pentest workflow on every sweep. The honest read: both are credible, both are continuously discovering and fingerprinting assets, and the meaningful question is whether the ASM layer feeds your specific workflow naturally. Feature-counting "data points" is not a useful comparison.
AI augmentation philosophy
Bishop Fox launched Cosmos AI on February 10, 2026 as an internal tester augmentation engine, with the explicit positioning that "no unvalidated findings are ever delivered to the customer." Lorikeet uses the Anthropic API for AI enrichment in the findings workflow — AI assists the human pentester in framing findings, mapping to remediation, and contextualizing severity. Both platforms use AI to accelerate humans; neither uses AI to replace pentesters. The technical stacks differ (proprietary vs. Anthropic), but the philosophy is the same.
Time-to-finding
Bishop Fox's Cosmos AI claims "hours to days" for initial validated findings and within five business days for final results — a real, specific commitment that is well above legacy pentest cadences. Lorikeet's continuous PTaaS model with KEV-matched re-testing is comparable: when a critical CVE drops in your stack, you get a finding within hours, not at the next quarterly engagement. Both platforms compress the cadence dramatically vs. annual pentesting; neither has a categorical edge.
Continuous re-test economics
Lorikeet includes free retesting in the engagement scope — once you remediate, we verify your fix at no additional cost. Bishop Fox's continuous managed-service model includes re-tests as part of the year-round engagement. Both vendors have moved past the legacy "retest is a separate engagement" pattern that enterprise pentest firms used in the 2010s. The economics question is more about total contract value: at growth-stage scale Lorikeet's published pricing makes the math obvious; at Equifax scale Bishop Fox's quote-only model is sized to the engagement complexity.
Buyer fit (the most important axis)
This is the axis that determines almost every other answer in this comparison. Bishop Fox Cosmos is built for Fortune 500 / large-enterprise buyers with internal red teams that want a "second set of eyes" (Equifax's words) operating continuously, with the procurement infrastructure to handle quote-only enterprise contracts, and with attack surfaces measured in thousands of domains. Lorikeet PTaaS is built for SaaS, AI, fintech, and healthcare growth-stage companies that need offensive testing aligned to enterprise compliance requirements (SOC 2, HIPAA, PCI-DSS, FedRAMP), want modern workflow ergonomics, value pricing transparency, and need to start engagements without a months-long procurement cycle.
Cosmos is overkill (and likely cost-prohibitive) for a Series A SaaS. Lorikeet is purposely not positioned for the Equifax-scale roster. This is not a competition between products that should win every deal — it is two vendors built deliberately for different buyers.
The Honest Summary
If you're an enterprise buyer with internal red team, multi-thousand-domain attack surface, and procurement that runs on quote-only enterprise contracts: Bishop Fox Cosmos is the right answer. We do not pretend otherwise.
If you're a SaaS, AI, fintech, or healthcare growth-stage company that values pricing transparency, modern PTaaS workflow ergonomics, white-glove human access through a portal, and continuous testing aligned to KEV-listed CVEs in your stack: Lorikeet PTaaS is built for you. That's our buyer profile, and we are deliberately good at it.
The wrong way to read this comparison is as a winner-take-all evaluation. The right way to read it is as a sorting function for which buyer you actually are. Both products are real, both are well-built, both have human pentesters and continuous platforms behind them. Pick the one that fits your stage.
Want to See What Lorikeet PTaaS Looks Like Against Your Attack Surface?
Book a scoping call — we will walk through what continuous testing of your specific environment would surface, what the engagement structure looks like, and what it costs (with transparent line items, not a quote-only number you have to ask for). If Bishop Fox Cosmos is genuinely the better fit for your stage, we will tell you that too.
