Autonomous penetration testing requires balancing depth with execution speed and compute cost. Running an exhaustive, multi-step exploit chain that inspects thousands of API endpoints on every commit in a CI/CD pipeline would choke deployment velocity. Conversely, running a lightweight 15-minute smoke scan before an annual SOC 2 Type II audit would leave catastrophic authorization flaws unexamined.
To address different operational rhythms, Lorikeet Security structured Lory around three distinct depth profiles: Surface, Standard, and Deep. Powered by deterministic token budgeting and our Vector Priority Ranking algorithm, Lory ensures maximum offensive coverage within predictable time and cost boundaries.
The Three Lory Depth Profiles Explained
Each profile calibrates the number of attack vectors engaged, maximum tool invocations permitted, recursion depth for subagents, and allowable wall-clock execution time.
Rapid CI/CD & Smoke
Designed for continuous integration gates, PR triggers, and quick regression verification.
- Vectors: ~4 primary attack vectors
- Tool Calls: Up to 40 tool executions
- Duration: 15 to 30 minutes
- Best For: Commit checks, staging deploy gates
Weekly & Sprint Releases
Comprehensive baseline evaluation covering OWASP Top 10 and business logic flaws.
- Vectors: ~8 attack vectors
- Tool Calls: Up to 120 tool executions
- Duration: 1 to 3 hours
- Best For: Production sprint releases, weekly posture checks
Compliance & Annual Audits
Exhaustive multi-step exploit chaining, deep API fuzzing, and lateral movement paths.
- Vectors: Full offensive catalog (15+ vectors)
- Tool Calls: Up to 350 tool executions
- Duration: 6 to 12 hours
- Best For: SOC 2, ISO 27001, PCI DSS, annual audits
Vector Priority Ranking: Attacking Critical Paths First
Unlike unguided brute-force scanners, Lory does not distribute tool budgets uniformly. Our orchestrator evaluates targets using a deterministic Vector Priority Ranking algorithm that orders execution by blast radius and exploitability:
| Priority Rank | Attack Vector | Rationale & Impact Analysis | Profile Inclusion |
|---|---|---|---|
| Rank 1 | SQL Injection (SQLi) | Direct database exfiltration and arbitrary query execution. Highest immediate blast radius. | Surface, Standard, Deep |
| Rank 2 | Server-Side Request Forgery (SSRF) | Cloud metadata endpoint compromise (IMDSv1/v2) and internal network pivot capabilities. | Surface, Standard, Deep |
| Rank 3 | Authentication & Session Bypasses | JWT signature manipulation, token forgery, and OAuth redirect flow hijacking. | Surface, Standard, Deep |
| Rank 4 | Broken Object Level Authorization (IDOR) | Multi-role cross-tenant data leakage across REST and GraphQL endpoints. | Standard, Deep |
| Rank 5 | Privilege Escalation & Delegation | Active Directory Kerberos roasting, role elevation, and AWS IAM role assuming. | Standard, Deep |
| Rank 6 | Infrastructure Misconfigurations | CORS wildcard permissions, debug headers, exposed S3 buckets, and information disclosure. | Deep |
If a Surface or Standard run discovers a confirmed high-severity finding (such as a blind SQL injection or an unauthenticated SSRF), Lory's orchestrator can dynamically reallocate tool budget from lower-ranked vectors to immediately verify the exploit chain and gather definitive evidence.
Preventing Runaway Loops with Token Budgeting
Autonomous agents using large language models can succumb to reasoning traps-repeatedly trying similar tool payloads or traversing endless pagination loops. Lory eliminates this failure mode through three hierarchical budgeting layers:
- Hard Tool Limits: Subagents are strictly terminated once their allocated tool budget is exhausted, preventing infinite recursion.
- Message Compaction: Before reaching token thresholds, Layer 1 executes intelligent message pruning, distilling tool outputs into concise state summaries to maintain context freshness.
- Throttled API Calls: Built-in rate limiting with exponential backoff guarantees compliance with target system rate limits and prevents Denial of Service conditions.
Choosing the Right Profile for Your Organization
High-velocity engineering teams commonly deploy a hybrid cadence:
- Every Pull Request: Surface profile triggered via GitHub Actions or GitLab CI to catch obvious regressions before merge.
- Weekly Cadence: Standard profile executed against staging or pre-production environments over the weekend.
- Quarterly / Pre-Audit: Deep profile executed against production or production-mirror systems to provide countersigned audit reports for SOC 2, ISO 27001, and PCI DSS compliance.
Optimize Your Pentest Cadence with Lory
Configure tailored depth profiles that safeguard your engineering velocity while guaranteeing bulletproof compliance coverage.
