Product Knowledge Base

Getting Access

Lorikeet Security operates two client portals. One account accesses both.

1. Sign up at /ptaas/signup

   Use a corporate email. Free providers (Gmail, Yahoo, etc.) are not accepted.

2. Verify your email

   Check your inbox for the verification link. Expires in 24 hours.

3. Log in to your chosen portal

   Use the portal toggle on the login page to switch between PTaaS and ASM.

4. Choose a plan or activate a demo

   Demo accounts can be activated instantly with a code from the pricing page.

Portals at a Glance

The PTaaS portal gives your team full visibility into every pentest Lorikeet Security runs. Track project status, review findings in real time, mark remediations, communicate with the team, and download final reports without waiting for email updates.

Projects

A Project represents a single scoped pentest engagement with a type, timeline, assets, and findings attached.

Project Lifecycle

1. Contracting

   Scope agreed, SOW being finalized.

2. Actively Pentesting

   The Lorikeet team is live in your environment.

3. Remediation

   Findings delivered; your team is fixing vulnerabilities.

4. Retest

   The team verifies your fixes.

5. Completed

   Final report issued. Project archived.

Project Types

Assets

Assets define the scope of your engagement what the pentest team is authorized to test.

Testing Types

Findings

Severity Levels

Finding Statuses

• Open Confirmed, not yet remediated
• Ready for Retest Fixed by your team; awaiting verification
• Remediated Fix verified by Lorikeet
• Accepted Risk Formally accepted by your organization
• False Positive Removed after further analysis

To request retest: click Mark Ready for Retest on the finding detail page. The Lorikeet team verifies and updates the status within the agreed retest window.

Reports & Deliverables

• Executive Summary Business-level risk overview for leadership and board communication
• Technical Report Full findings with reproduction steps, evidence, and remediation
• Evidence Package Raw HTTP requests/responses, screenshots, and PoC files
• Retest Attestation Issued after Critical and High findings are verified remediated
• Compliance Letter Where applicable (SOC 2, PCI DSS, ISO 27001)

Team Management

1. Settings → Organization

   Only the account owner or admins can invite members.

2. Enter the team member's email

   Must match your company domain.

3. They receive an invite email

   Invites expire after 72 hours. You can resend from the pending list.

4. Member accepts and sets a password

   Automatically added to your company workspace.

Billing

Lorikeet Security uses Stripe for payments, managed from Settings → Billing.

• All major credit cards accepted
• Invoice-based billing for enterprise accounts
• Invoices sent to your registered email automatically
• Receipts and history downloadable from the billing portal

Full Engagement Workflow

1. Sign up and create a project

   Select your project type and add assets.

2. Scope call with the team

   A Lorikeet engineer confirms the testing approach. Project moves to Contracting.

3. SOW signed, engagement scheduled

   You receive a start date and a dedicated point of contact.

4. Active testing

   Findings appear live in your dashboard as they are confirmed.

5. Findings delivered

   Project moves to Remediation. Mark fixed items as ready for retest.

6. Retest

   The Lorikeet team verifies all critical/high findings.

7. Final report

   Full PDF report available in the portal. Attestation letter issued.

The ASM portal runs ongoing security scans against your registered domains, alerting you when new subdomains appear, misconfigurations emerge, or vulnerable services are exposed.

Domain Management

Add root domains you own. The scanner discovers and monitors all subdomains automatically.

1. ASM → Domains → Add Domain

   Enter your root domain (e.g. example.com).

2. Verify ownership (some plans)

   Add a DNS TXT record to confirm ownership.

3. Domain is monitored continuously

   Scans run on schedule. Manual scans can be triggered anytime.

Domain Limits by Plan

Scan Jobs

1. Phase 1: Subdomain Enumeration

   DNS enumeration, certificate transparency logs, and brute-force wordlists.

2. Phase 2: Security Checks

   Open ports, TLS/SSL config, HTTP headers, admin panels, subdomain takeover risk, and more.

3. Phase 3: AI Enrichment + Screenshots

   Findings enriched with KB context, attack scenarios, and remediation. Screenshots captured.

ASM Findings

• TLS/SSL Expired certificates, weak ciphers, missing HSTS
• Security Headers Missing CSP, X-Frame-Options, CORP, etc.
• Exposed Services Admin panels, databases, RDP/SSH exposed to the internet
• Subdomain Takeover Dangling DNS records pointing to unclaimed cloud resources
• Open Ports Unexpected services on non-standard ports
• Outdated Software Detected versions with known CVEs
• Misconfiguration Public S3 buckets, exposed environment files

Each finding includes an AI Chat assistant ask "How do I fix this in nginx?", "What's the CVSS score?", or "What's the real-world impact?" and get contextual answers grounded in your specific finding.

Vulnerability Knowledge Base

ASM findings are enriched against nearly 2,000 KB entries sourced from:

• OWASP ASVS Application Security Verification Standard
• OWASP WSTG Web Security Testing Guide
• OWASP Top 10 Most critical web application risks
• MITRE CWE Common Weakness Enumeration
• MITRE CAPEC Common Attack Pattern Enumeration

Plans & Limits

ASM is available as a standalone subscription. See /asm#pricing for current pricing.

Lory is Lorikeet Security's AI assistant, trained on our full service catalog, pricing, methodology, and a knowledge base of nearly 2,000 vulnerability entries from OWASP, MITRE, and industry frameworks. Lory helps visitors understand cybersecurity concepts in plain English, find the right service, compare pricing, and navigate the platform. In the authenticated portal, Lory has live access to your projects, findings, and assets for personalized security guidance.

Response Types

Lory replies with structured content blocks for a richer experience than plain text.

Where to Find Lory

• Dedicated page /lory for a full-screen chat experience with voice input and output
• Widget The floating chat bubble on every page of the website
• Dashboard Authenticated Lory inside the PTaaS and ASM portals with live access to your projects, findings, and assets

Integrations

Connect Lorikeet Security to your existing toolchain from Dashboard → Marketplace. We support 30+ integrations across 9 categories. View the full marketplace.

Notifications & Alerting

Project Management & Ticketing

Code Repositories

Coming Soon

We're expanding our marketplace with enterprise-grade integrations across SIEM, compliance, cloud security, CI/CD, and vulnerability management:

Request an integration if you don't see your tool listed.

For full webhook payload format and signature verification, see the Developer Documentation.

Webhooks

• finding.created New confirmed finding added to a project
• finding.updated Finding severity or status changes
• finding.resolved Finding marked remediated by the pentest team
• scan.started / scan.completed ASM scan job lifecycle
• asset.discovered New asset found during ASM enumeration
• ticket.created / ticket.updated Support/retest ticket changes

FAQ

Can I use both portals with one account?

Yes. One Lorikeet Security account grants access to both. Use the portal toggle on the login page.

How long do findings take to appear after a scan?

PTaaS findings appear in real time. ASM scan jobs complete in 3–10 minutes for small-to-medium attack surfaces.

Can I export findings to CSV or PDF?

PDF export is available from the findings dashboard. JSON/CSV export is available via the API.

What domains can I add to ASM?

Only domains and IP ranges you own or have written authorization to test.

How do I request a retest?

Click Mark Ready for Retest on the finding detail page. The team is notified automatically.

Can I invite my developers?

Yes. From Settings → Organization you can invite any number of team members. All members see the same workspace data.

Contact Support

Last updated: March 2026  ·  Lorikeet Security