An AI pentester that runs the whole engagement.
A human signs the report.
Lory takes a signed scope, runs recon, picks her own attack vectors, proves the exploit and drafts the finding. Then a Lorikeet pentester countersigns it, and that signature is what your SOC 2 or ISO 27001 auditor accepts.
What actually lands in your hands.
Not a dashboard you have to interpret. An engagement closes with the same artifacts a traditional pentest produces, plus two most firms can't give you: a record of what wasn't tested, and a machine-readable export your pipeline can consume.
The report
Executive summary, scope, methodology, findings with CVSS severity, remediation guidance and retest status, in the format CPA firms and certification bodies already accept.
Control mapping
Every finding carries its CWE and the control it breaks: Trust Service Criteria for SOC 2, Annex A for ISO 27001, and the equivalents for PCI-DSS, HIPAA, CMMC, GLBA and CIS.
Proof, per finding
The request and response that demonstrate the issue, screenshots where they help, and the chain it unlocked. A signal isn't a finding until it's been reproduced.
A coverage record
Vectors planned, vectors run, vectors never reached and the reason why. When your auditor asks what was tested, you hand them the answer instead of reconstructing it.
Retests and the fix trail
Auditors want evidence that findings were closed, not just found. File a retest from the portal or your terminal, and only a human closes a finding.
Machine-readable export
The same engagement as SARIF 2.1.0 for GitHub code scanning, or over MCP for your own tooling. Your findings stop living in a PDF nobody opens twice.
Where this sits against a scanner and a pentest firm.
Scanners are cheap and constant but prove nothing. Traditional engagements prove plenty but arrive twice a year, if the calendar cooperates. The point of an AI pentester is to take the frequency of the first and the evidentiary weight of the second, which only works if a qualified human still signs the result.
| Vulnerability scanner | Traditional pentest firm | LorikeetLory + a human pentester | |
|---|---|---|---|
| time to start | Immediate | Weeks, waiting on a tester's calendar | Same day you sign the scope |
| what you get back | Unvalidated signals to triage | Proven findings | Proven findings, plus what they chain into |
| business logic | Missed; no concept of your app | Covered | Covered; vectors chosen from live recon |
| evidence | A signature matched a pattern | Written up by hand | Captured request/response, screenshots, CWE |
| who signs it | Nobody | Your tester | Your tester. Lory drafts, a human countersigns |
| audit evidence | Rarely sufficient on its own | Accepted | Accepted, and pre-mapped to your framework |
| tells you what it missed | No | Rarely | Every run, with the reason attached |
| retesting | Re-run the scan | Often a new statement of work | On demand, against your existing balance |
| cost model | Annual licence | Fixed bid per engagement | Prepaid credits, no seats, no subscription |
If you'd rather skip the AI entirely, our pentesters will run the engagement by hand: same report, same signature, traditional timeline. That option never goes away.
Get your audit evidence in days, not a quarter.
SOC 2 and ISO 27001 stall on the same line item: independent evidence of technical security testing, dated inside the audit period, with findings triaged and retested. That evidence normally waits on somebody's calendar. Lory doesn't have one.
Scope and quote
You declare targets and sign the rules of engagement. Itemised quote back within 24 hours.
Lory runs
Recon starts the day the scope is signed. Depth sets the run length. No queue, because she doesn't have a calendar.
A human signs
A Lorikeet pentester reads the evidence, rates the risk and countersigns. The report goes out on our letterhead.
Fix and retest
Remediate, file a retest, and the closure evidence joins the audit file. This is the part to leave time for.
Why an AI report alone won't clear your audit
Auditors require independent testing by a qualified third party, documented. Raw autonomous output isn't that, and no auditor will treat it as one, which is the part most AI pentest tools quietly skip. Here the machine does the volume and a human does the attestation, so what you hand your auditor is a signed report rather than a tool export you still have to defend.
- who signs it
- SOC 2
CC7.1and ISO 27001A.8.8are satisfied by a qualified independent tester, not by software. If your auditor wants to talk to a human about methodology, they get one. - scope you can defend
- Auditors ask what was tested. The better ones ask what wasn't. The coverage record answers both. Most pentest reports simply can't.
- inside the period
- Type II observation windows and ISO surveillance audits both punish point-in-time testing. Credits are prepaid with no per-engagement contract, so re-testing after a major release is a same-week run, not a new procurement cycle.
| what she proves | SOC 2 | ISO 27001 Annex A |
|---|---|---|
| idor | CC6.1 · CC6.3 | A.8.3 |
| auth-bypass | CC6.1 | A.8.5 |
| sqli | CC7.1 | A.8.28 |
| ssrf → cloud creds | CC6.6 | A.8.20 |
| unpatched service | CC7.1 | A.8.8 |
| exposed admin panel | CC6.6 | A.8.9 |
| weak transport crypto | CC6.6 | A.8.24 |
| vulnerable dependency | CC8.1 | A.8.25 |
Worth saying plainly: a penetration test is one control in a framework, not the framework. Lory won't write your policies, run your risk assessment or sit your audit, and we are not your auditor. What she removes is the months you'd otherwise spend waiting on the one piece of evidence that has to come from outside your company.
Have an audit date already?
Tell us the date and we'll work the scope backwards from it, including time to fix what she finds.
One engagement, start to signed.
This is the actual shape of a Lory run: the same stages that show up in the log, in the same order. Nothing here is a metaphor for something else.
Scope is a gate, not a suggestion
You declare targets and sign the rules of engagement in the portal. Every single tool call is checked against that allowlist first. scope_check runs before anything touches a host, and an out-of-scope target is never contacted. Pick a depth: surface, standard or deep.
Deterministic sweep
Before any judgement calls, a fixed sweep establishes ground truth: DNS, live HTTP surface, service fingerprints, open ports, a screenshot. Same inputs, same output, every run, so the interesting part starts from facts rather than guesses.
One focused pass per attack vector
The orchestrator picks the vectors that apply to what it just found, ranks them by offensive impact, and gives each one its own pass with its own budget. SQLi gets a pass. IDOR gets a pass. SSRF gets a pass. Each pass loads the matching playbook and works only that angle. No thin, scattered coverage.
Validate, then chain
A signal isn't a finding. Lory proves it, screenshots it, and looks for what it unlocks: SSRF into instance metadata into cloud credentials into production data. Findings land with evidence, a CWE, and a mapping to the compliance controls they break.
A human signs, or it doesn't ship
Everything Lory writes lands in pending_review and stays invisible to you until a Lorikeet pentester reads the evidence and approves it. Risk rating, exploitation judgement, executive summary and final sign-off are ours. This is the part we won't automate.
What she can actually test.
You declare an asset, pick a depth of Surface, Standard or Deep, and Lory runs it. She covers every asset type we test but one: physical security is human-led and never run by Lory.
| engagement | who runs it | what it covers |
|---|---|---|
| web app · API | Lory | Crawl, authentication testing, injection and access-control checks against a web app or API |
| network | Lory | External hosts, and internal ranges through the mesh connector: services, versions, exposure |
| cloud | Lory | AWS, Azure, GCP, Kubernetes, containers and serverless: IAM, metadata paths, privilege escalation and persistence |
| mobile | Lory | iOS and Android applications and the backends behind them: data storage, IPC and deep links, pinning, resilience |
| source repo | Lory | Source and supply-chain review of a connected repository: secret hunting and SAST-style sink tracing |
| physical | Human-led | Routed to your Lorikeet team. This is the one engagement type Lory never runs |
The playbook library behind it
104 written playbooks across 12 categories. Lory doesn't carry one giant prompt: each attack class is its own playbook with methodology, payloads, false-positive traps and what proof looks like, and she loads exactly the one the current pass needs. Depth per vector instead of a checklist skimmed thin.
Web & API
28- sqli · nosql · rce · ssti
- ssrf · xxe · file-inclusion
- idor · business-logic
- deserialization · race-condition
- graphql · websockets · cors
- request-smuggling · cache
- prototype-pollution · waf-bypass
- + 11 more
Authentication
14- oauth · saml · jwt
- webauthn · mfa · mtls
- session-management
- account-recovery
- ntlm · ldap · legacy-sso
- api-auth · http-auth
- + 1 more
Cloud
14- aws · azure · gcp
- kubernetes · containers
- serverless · saas-security
- entra-id · ci-cd-oidc
- imds-ssrf · privesc
- persistence · data-exfil
- + 2 more
Network
13- external-perimeter
- network-layer · services
- credential-attacks
- windows-privesc · linux-privesc
- pivoting-tunneling
- wireless · voip
- printers-iot-ot · network-devices
- + 2 more
Active Directory
8- ad-recon · ad-credentials
- ad-privesc · ad-lateral-movement
- ad-persistence · ad-trusts
- adcs
Mobile
8- ios · android
- data-storage · ipc-deeplinks
- network-pinning · resilience
- mobile backend
AI systems
6- prompt-injection
- llm-agents · rag-security
- mcp-security
- model-supply-chain
Code & supply chain
4- source-review · sast
- secrets-scanning
- supply-chain
Recon
3- osint · osint-methodology
- subdomain-takeover
Desktop
1- thick-client
Operating rules
3- rules-of-engagement
- operator-identity
- findings-format
Utility
2- reporting
- fast-checking
A code review needs a repository that is actually connected (provider plus access token), not merely registered. Which playbooks load is driven by engagement depth and what recon actually found, so a web-only scope never burns budget on Active Directory. Behind them sits a 1,969-entry vulnerability knowledge base built from OWASP ASVS, WSTG and Top 10 plus MITRE CWE and CAPEC, searched during enrichment so findings arrive with real remediation guidance rather than a generated paragraph.
We'll also tell you what she didn't test.
Every AI security tool shows you what it found. The harder number is what it never got to. Each engagement emits a coverage record: vectors planned, vectors that ran, and vectors cut short by the time or token ceiling, with the reason attached.
If a run stops two vectors short, that's in your engagement record and your pentester sees it before sign-off. You can raise the depth and rerun. What you can't do is mistake an unfinished run for a clean one.
Your engineers get the findings where they already work.
A test ends with findings; the work ends when the code changes. Two of these are open source and MIT-licensed. Read them, fork them, run them without a platform account.
In the terminal
A Python TUI and CLI that pulls approved findings into the repo, points git grep at the lines responsible, asks Lory for the fix and files the retest, without leaving the codebase you're fixing.
- Traces findings to candidate lines by parameter, route and CWE sink
- Source is attached only if you opt in, per request
- SARIF 2.1.0 export becomes GitHub code-scanning annotations
- It scans nothing; findings come from the engine, post-review
Inside your network
Internal testing without opening your perimeter. One command on one machine inside the network opens a single outbound, encrypted connection, and for the duration of the engagement Lory can reach the internal ranges that machine can see, using her full toolbelt unchanged.
- One install command, Linux, macOS or Windows
- Outbound only; no inbound port, no appliance, no config file
- Scoped to the engagement and enrolled with a one-time token
- Separately,
lk-exporteris our MIT per-host sensor for patch state, inventory and supply-chain posture
In your own AI tools
Point Claude, Claude Code or any MCP client at your findings, asset inventory, compliance posture and the vulnerability knowledge base, and let your own agents do the reading.
- OAuth 2.1 or a workspace token, scoped per token
- Access hard-limited to your own company's data
- Unreviewed findings are never returned on any read path
- Billed at 0.1 credit per tool call
# cockpit, or CLI-only for CI pip install "lory-code-security[tui]" lory findings list --severity critical lory trace 41 ▸ src/reports.py:88 dateFrom sql = "… WHERE d >= '" + dateFrom + "'" lory fix 41 --code lory retest 41 → a human re-tests. only that closes it.
Not ready to book? Ask her first.
No account, no form. Ask what an engagement would cost for your stack, what your SOC 2 evidence needs to cover, or what a finding in someone else's report actually means. Signed in she goes further, pulling your live findings, drafting an executive summary, scoping an engagement, or booking time with a human when you'd rather have one.
Prepaid credits. No seats.
Load a balance and Lory draws from it as she works. $1 buys 1 credit, MCP tool calls cost 0.1 credit, and engagements bill by depth. Credits gate the start of a run, so nothing begins that you haven't funded.
- ≈ 1,000 MCP tool calls
- Your first scoped engagement
- Every finding human-reviewed
- ≈ 2,500 MCP tool calls
- Multi-target, multi-stage chains
- Compliance-mapped reporting
- ≈ 5,000 MCP tool calls
- Room for deep, long-running runs
- Full vector coverage at depth
- ≈ 10,000 MCP tool calls
- Program-level, ongoing testing
- Priority human review
The things people actually ask.
What auditors require is independent testing by a qualified third party, documented, and that's satisfied by the Lorikeet pentester who scopes the run and signs the report, not by Lory herself. She's how the work gets done; the attestation is ours. Reports carry scope, methodology, severity ratings, remediation guidance and retest status in the format CPA firms and certification bodies already accept, plus a control mapping section: Trust Service Criteria for SOC 2, Annex A for ISO 27001. If your auditor wants to talk to a human about methodology, they get one.
A quote inside 24 hours, and recon starts the same day you sign the scope. There's no waiting on a tester's calendar, because Lory doesn't have one. Depth sets how long the run takes; human review and the write-up follow. The honest constraint isn't the testing, it's the fixing: auditors want to see findings remediated and retested, so scope early enough to close what she finds. For an ISO 27001 Stage 2 we'd still say test two to three months out.
It's prepaid and usage-based, with no subscription and no seat licences. Load credits ($1 = 1 credit), and Lory draws down as she works: 0.1 credit per MCP tool call, and engagements billed by depth. Preset packs run $100–$1,000, or set any custom amount from $25 to $25,000 in the billing tab.
No, and the workflow makes that structural rather than a promise. Everything Lory writes lands in a review queue and is invisible to you until a Lorikeet pentester reads the evidence and approves it. She covers volume: recon, validation, chaining, first-draft write-ups, round the clock. Scoping, exploitation judgement, risk rating and the final report are ours.
A scanner runs a fixed template set and hands you a list of maybes. Lory picks her attack vectors from what she found on your system, loads the matching playbook, proves the issue, and then looks for what it unlocks. The output is a demonstrated path with captured evidence, not raw signal you still have to triage.
Scope is enforced in code, not policy. Every tool call resolves its target against your signed allowlist before it executes, and an out-of-scope host is never contacted. Destructive tooling isn't in the toolbelt, a pentester oversees the run, and the full log of what was attempted is yours to read afterwards.
You're told. Every engagement records the vectors it planned, the ones it ran, and the ones it never reached because the time or token ceiling hit first. That record reaches your pentester before sign-off and reaches you in the engagement view. Raise the depth and rerun to close the gap.
For external testing, no. Lory runs entirely in the Lorikeet portal, and you can scope a run and have her starting recon the same day. Internal network testing needs one thing: the Lory Mesh connector, installed with a single command on one machine inside the network you want tested. It opens an outbound encrypted connection for the life of the engagement, so no inbound port is exposed and there is no appliance to rack. Separately, our MIT-licensed lk-exporter agent can sit on individual hosts to report patch state, inventory and supply-chain posture, but it is not what internal testing runs on.
Yes. The MCP server exposes your findings, assets, compliance posture and knowledge base to any MCP client: Claude, Claude Code, or your own. Auth is OAuth 2.1 or a workspace token, scopes are per-token, and access is hard-limited to your own company's data.
Scope one engagement and see what she finds.
No waitlist and no separate contract. The AI pentester is live in the portal today. Book thirty minutes and we'll scope your first run together; if there's an audit date on the other end of it, we'll work backwards from that. Quote inside 24 hours, recon the day you sign.