How to Migrate from Cacilian to Lorikeet Security: The 4-Stage Zero-Downtime Playbook

Switching your penetration-testing-as-a-service (PTaaS) provider is one of the highest-stakes operational moves an engineering leader can make. For companies currently using Cacilian — the PTaaS platform launched by Prescient Security in 2023 and recently acquired by Swiss multinational testing giant SGS in October 2026 — the decision to switch is driven by real operational pain points:

• Opaque, Inflated Pricing: Cacilian does not publish standard rates; engagements are negotiated behind sales friction, and renewals under SGS often bring steep enterprise minimum commitments.
• Lagging Platform Innovation: While modern security demands autonomous reasoning and instant CI/CD re-testing, Cacilian remains primarily a static ticketing portal for ordering scheduled project-based tests.
• The "Audit Observation Gap" Anxiety: In the middle of an active SOC 2 Type II, ISO 27001, or FedRAMP observation period, security leaders worry that terminating an existing vendor will cause auditors to question evidence continuity or delay funding milestones.

This playbook provides the exact 4-Stage Zero-Downtime Migration Framework used by engineering teams to migrate from Cacilian to Lorikeet Security's Talon platform in under 48 hours without missing an audit beat, losing historical findings, or paying twice for unspent retainer balances.

The Core Challenge: Maintaining Audit Observation Continuity

In a continuous compliance framework (such as SOC 2 Type II or ISO 27001:2022 clause A.8.8), auditors do not simply look for an attestation letter; they evaluate control continuity over an extended observation window (typically 3, 6, or 12 months). If your previous vendor completed a pentest in Month 2, and you terminate their portal in Month 6 without linking the remediation lifecycle, auditors may flag an "observation gap" — asking whether discovered vulnerabilities were ever validated or whether new releases went untested.

The 4-Stage Zero-Downtime Migration Framework

Detailed Technical Walkthrough: Executing the 4 Stages

Stage 1: Historical Evidence & Report Ingestion in 60 Seconds

The single biggest operational hurdle when switching PTaaS providers is the loss of historical remediation context. When moving away from Cacilian, teams frequently find that past findings are locked in static PDF reports or proprietary portal databases. Manually copying hundreds of vulnerabilities, CVSS strings, and developer remediation comments into a new tool can consume weeks of engineering time.

Lorikeet solves this with the Talon 60-Second PDF Ingestion Engine. Built with specialized OCR parsing models trained on leading pentest formats (including Cacilian, Prescient Security, NetSPI, Cobalt, and Bishop Fox), Talon ingests your existing PDF deliverables and extracts:

• Finding Title & Severity: CVSS v3.1 base metrics, temporal scores, and vector strings.
• CWE / OWASP Classifications: Normalized against OWASP Top 10 2025 and CWE Top 25.
• Affected Assets & URLs: Target subdomains, API routes, and parameter names.
• Historical Remediation Status: Identifying which vulnerabilities were closed, accepted as business risks, or remained open.

Stage 2: Scope Reconciliation & Direct Compliance Telemetry Mapping

Once your historical baseline is loaded, the next step is reconciling your target attack surface with your compliance automation platform. Unlike legacy testing shops that require static, pre-scheduled asset lists, Talon dynamically syncs with cloud providers and compliance tooling.

Connecting Drata, Vanta, and Secureframe

Talon provides native bi-directional compliance telemetry. Rather than waiting until the end of an engagement to manually export PDFs and upload them into your trust center, Talon's integration streams findings and verification certificates automatically:

1. Authenticate Talon with your Compliance Platform: Generate an API key in Drata or Vanta and paste it into Talon's Settings > Compliance Integrations panel.
2. Map Test Evidence to Security Controls: Talon automatically maps incoming test results to relevant SOC 2 Common Criteria controls (such as CC7.1 for vulnerability scanning, CC7.2 for independent penetration testing, and CC7.3 for incident response readiness).
3. Automated Retest Evidence Streaming: When an engineer marks a vulnerability as fixed in Talon and our human testers verify the patch, the status in Drata/Vanta updates to "Passed" instantly, attaching the verified retest proof.

Stage 3: Parallel Validation & Baseline Delta Pentesting

With scope and compliance integrations active, Lorikeet initiates the Delta Pentest Phase. This phase serves two critical functions:

1. Verifying Previous Cacilian Remediations: In high-turnover testing environments, findings marked as "remediated" in previous audits are often inadvertently reintroduced during major software refactors. Our offensive team re-tests previous high and critical findings to ensure defenses hold.
2. Exposing Checklist Blind Spots: Traditional pentest shops often rely on standardized vulnerability templates and high-level automated scanners. Lorikeet combines Lory — our autonomous AI pentesting agent capable of crawling complex multi-step application workflows — with senior certified human offensive security engineers (OSCP, OSWE, CISSP). This hybrid approach catches critical vulnerabilities that checklist audits routinely miss:
   • BOLA / IDOR in API endpoints: Cross-tenant parameter manipulation that automated tools cannot identify without application context.
   • Race Conditions in Transactional Workflows: Concurrency flaws in payment processing, coupon redemptions, and cryptographic key generation.
   • AI & LLM Application Exploits: Indirect prompt injection, system prompt extraction, and insecure vector database queries.

Stage 4: Cutover, Attestation Handshake & Contract Value-Match

The final phase completes the migration and provides everything your board, executive team, and external auditors require:

1. 100% Human-Countersigned Attestation Letter

Auditors do not accept unverified AI reports. Every assessment delivered through Talon culminates in a formal attestation report signed by credentialed, US-based senior offensive security engineers. Our attestations maintain a 99.8% first-pass auditor acceptance rate across Big Four firms (Deloitte, PwC, EY, KPMG) and leading SOC 2 CPA practitioners.

2. The Contract Value-Match Guarantee + 20% Bonus Credits

If you have unexpired contract time or prepaid credits with Cacilian or Prescient Security, Lorikeet eliminates financial friction. Provide a copy of your active agreement or invoice, and we will:

• Match the remaining contract value dollar-for-dollar as a credit toward your Talon PTaaS subscription.
• Add an additional 20% bonus in testing credits to your account, giving your team extra testing capacity for new microservices, API integrations, or major product launches.

3. Decommissioning Cacilian with Data Portability

Once your Lorikeet attestation is published and your Drata/Vanta telemetry is flowing, you can safely archive your Cacilian records. Download your final raw exports, submit your non-renewal notification to SGS/Prescient, and operate with complete confidence that your compliance posture is stronger, faster, and fully audit-ready.

Frequently Asked Questions About Cacilian Migration

Will switching vendors trigger a full SOC 2 Type II audit reset?

No. SOC 2 Type II audits evaluate whether defined security controls are operating effectively throughout the observation period. Replacing a pentesting vendor is treated as an operational vendor management process (governed under CC9.2). As long as testing coverage remains continuous and the new provider issues a qualified, human-countersigned attestation, auditors will not reset your observation period.

How do we handle customer security questionnaires during migration?

If an enterprise prospect requests proof of an active pentest during your 48-hour migration, Lorikeet provides an immediate Interim Testing Letter of Attestation confirming that testing is underway, your scope is enrolled in continuous PTaaS, and formal results are streaming live into your compliance center.

Does Lorikeet charge extra for finding retests?

Never. Unlimited retesting is included with every Lorikeet engagement. When your developers push a remediation commit, they can trigger an immediate retest directly in Talon. Our engineers verify the fix and issue updated certificates at zero additional cost.

Lorikeet Security Team

Penetration Testing & Cybersecurity Consulting

Lorikeet Security helps modern engineering teams ship safer software. Our work spans web applications, APIs, cloud infrastructure, and AI-generated codebases — and everything we publish here comes from patterns we see in real client engagements.

Practical security, written by practitioners.