Offensive Security Red Team Ops Compliance Code Review Continuous Security AI & Emerging Tech White Papers

Our Security Testing Methodology

Battle-tested approaches refined across hundreds of engagements. We combine manual expertise with cutting-edge tooling to deliver thorough, actionable security assessments across 30+ service areas.

6 Methodology Areas 30+ Service Areas 14+ Compliance Frameworks 3 White Papers
Book a Scoping Call White Papers View all services
Methodology 01

Offensive Security Testing

Comprehensive penetration testing across web, API, cloud, network, and specialized environments using industry-standard frameworks.

Web App Pentesting API Pentesting Cloud Security Network Pentesting Mobile App Pentesting Active Directory IoT & Hardware Desktop & Thick Client ATM & Banking Physical Pentesting
OWASP Top 10 OWASP ASVS PTES NIST SP 800-115
1
Reconnaissance & Discovery

We map your complete attack surface through OSINT collection, DNS enumeration, subdomain discovery, technology fingerprinting, and service identification.

2
Vulnerability Assessment

Combining industry-leading scanners with custom scripts and manual inspection to systematically identify weaknesses across authentication, authorization, and business logic.

3
Exploitation & Validation

Every finding is manually validated and exploited in a controlled manner to demonstrate real-world impact. Zero false positives in your report.

4
Post-Exploitation

After gaining access, we assess the full extent of compromise -- lateral movement, privilege escalation paths, and data access analysis.

5
Reporting & Remediation

Detailed reports include executive summaries, CVSS v3.1/v4.0 scores, CWE mappings, and step-by-step remediation guidance tailored to your stack.

6
Free Retesting

After your team implements fixes, we retest every finding at no additional cost. Updated report ready for auditors and stakeholders.

Methodology 02

Red Team Operations

Adversary simulation engagements that test your detection and response capabilities against real-world threat actor TTPs.

Red Team Operations Purple Team Assessment Social Engineering Wireless Pentesting
MITRE ATT&CK TIBER-EU

Full-Scope

Complete adversary simulation from external recon through initial compromise, lateral movement, privilege escalation, and objective achievement.

Assumed Breach

Start with internal access to focus on lateral movement detection, privilege escalation prevention, and data exfiltration monitoring.

Targeted

Goal-oriented engagements focused on specific crown jewels or critical systems. We map every path to reach your most sensitive assets.

MITRE ATT&CK Coverage

Every engagement is mapped to MITRE ATT&CK, giving clear visibility into which tactics your defenses can detect and respond to.

Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Exfiltration C2 Impact

Attack Vectors

  • Social Engineering: Phishing, vishing, pretexting, impersonation
  • Physical Security: Facility penetration, tailgating, badge cloning
  • External Compromise: Web exploitation, VPN attacks, email compromise
  • Wireless Attacks: WiFi cracking, rogue APs, evil twin
  • Lateral Movement: Pass-the-hash, Kerberoasting, credential theft
  • Data Exfiltration: Covert channels, encrypted tunnels
Methodology 03

Compliance-Driven Testing

Security assessments designed to satisfy auditor requirements, regulatory mandates, and certification bodies.

SOC 2 ISO 27001 PCI-DSS HIPAA CMMC HITRUST GDPR NIST CSF FedRAMP NIS2 DORA SOX CCPA/CPRA CASA/MASA

What Makes Reports Auditor-Ready

  • Scoping Precision: We test exactly what your auditor requires with clear scope documentation and evidence mapping to specific control requirements.
  • Structured Evidence: Detailed screenshots, request/response logs, and PoC demonstrations for every finding, organized by control framework.
  • CVSS v3.1 Scoring: Industry-standard risk ratings with business impact analysis tailored to your compliance context.
  • Executive Summaries: C-level appropriate overviews demonstrating due diligence and security program maturity.
  • Remediation Timelines: Clear guidance with fix verification windows aligned to your audit schedule.

Attestation Letters

Signed attestation letters formatted for direct submission to auditors and certification bodies.

Free Retesting

Retest all findings after remediation at no cost. Updated report ready before your audit window.

Auditor Collab

We work directly with your auditors to answer questions and ensure reports meet their expectations.

Methodology 04

Secure Code Review

Deep manual source code analysis augmented by AI-assisted tooling and SAST integration to find vulnerabilities that runtime testing cannot reach.

Secure Code Review AI Vibe Coding Review Access & Permission Review
JavaScript / Node.js TypeScript Python Go Java PHP C# / .NET React / Next.js Ruby Swift / Kotlin

What We Review

  • Auth & Authorization Logic: Session management, role enforcement, OAuth/OIDC flows
  • Injection Points: SQL, NoSQL, LDAP, command, template injection
  • Cryptography: Key management, encryption implementations, hashing
  • Business Logic: Race conditions, state manipulation, workflow bypasses
  • Dependency Analysis: Known CVEs, supply chain risks, outdated packages
  • Data Handling: PII exposure, logging practices, secrets in code

Our Approach: SAST + Manual Hybrid

We run automated static analysis tools to establish baseline coverage, then layer deep manual review on top. Human reviewers focus on business logic flaws, complex authentication flows, and context-dependent vulnerabilities that automated tools consistently miss.

For AI-generated ("vibe coded") applications, we apply specialized review patterns targeting common LLM code generation weaknesses -- improper input validation, insecure defaults, and missing authorization checks.

Methodology 05

Continuous Security

Ongoing security testing, vulnerability management, and autonomous AI pentesting across your in-scope assets that runs 24/7.

Lory AI Pentester Vulnerability Management Patch Management SOC as a Service Attack Surface Management (ASM) Continuous Retesting
1
Autonomous AI Pentesting

Lory autonomously pentests web applications, APIs and network assets you have declared in scope, chaining reconnaissance and exploitation the way a human tester would. Cloud, mobile, source repositories and physical testing stay human-led.

2
Automated Scanning

Every asset is scanned for misconfigurations, exposed services, outdated software, and known vulnerabilities. Prioritized by exploitability.

3
AI-Powered Enrichment

Findings enriched with OWASP and MITRE CWE/CAPEC context using AI models. Each finding includes remediation guidance and attack scenarios.

4
Dashboard & Alerting

Real-time visibility through our client portal. Track vulnerabilities, monitor remediation progress, and receive critical change alerts.

Ongoing Monitoring

  • In-Scope Coverage: Continuous autonomous testing across every declared in-scope asset Lory has tooling for, with the rest picked up by our testers
  • Regression Detection: Immediate re-testing when your in-scope assets change, so new vulnerabilities surface fast
  • Trend Analysis: Track security posture improvements over weeks and months
  • Executive Reporting: Monthly summaries showing risk reduction metrics
Methodology 06

AI & Emerging Tech Security

Specialized testing for AI agents, LLMs, and AI-integrated applications -- an emerging attack surface that traditional pentesting does not cover.

AI Agent Pentesting LLM Security Assessment Prompt Injection Testing
OWASP Top 10 for LLM NIST AI RMF ISO 42001 EU AI Act

What We Test

  • Agent Permissions & Scope: Can the agent be tricked into unauthorized actions or accessing restricted resources?
  • Tool & API Access: Testing boundaries of tool-use capabilities and manipulation to call unintended endpoints
  • Prompt Injection: Direct and indirect injection attacks that override system instructions or exfiltrate data

Security Boundaries

  • Output Sanitization: Verifying AI outputs are properly sanitized before rendering or passing to downstream systems
  • Data Leakage: Testing whether training data, system prompts, or sensitive context can be extracted
  • Model Abuse: Rate limiting, cost attacks, resource exhaustion, and DoS vectors specific to AI workloads
Standards

Frameworks & Standards

Our methodologies are built on globally recognized security frameworks, continuously updated to reflect the latest threat landscape.

OWASP
MITRE ATT&CK
NIST
PCI-DSS
SOC 2
ISO 27001
HIPAA
CMMC
HITRUST
GDPR
FedRAMP
DORA
NIS2
CIS Controls
PTES
SOX
Why Us

What Sets Us Apart

Free Retesting

We retest every finding after remediation at no extra cost

Auditor Collaboration

Signed attestation letters and direct auditor communication

AI-Enhanced Testing

AI tooling accelerates discovery with human experts at the center

Client Portal

Real-time findings, remediation tracking, and attack surface monitoring

Human-Led Testing

Every engagement led by experienced professionals, not just scanners

Certified Experts

OSCP, OSCE, CEH, GPEN certified security professionals

Downloads

Methodology White Papers

Download our detailed testing methodology papers. These documents outline our approach, tools, and techniques across key engagement types - useful for clients, procurement teams, and security practitioners.

Web Application

Web Penetration Testing Methodology

Our comprehensive web application security testing approach covering OWASP Top 10, authentication bypass, injection flaws, business logic, API security, and session management.

  • OWASP Testing Guide v4.2
  • ASVS Level 2 & 3
  • Manual + Automated
  • API & REST Coverage
PDF 208 KB April 2026
Download PDF View Web App Pentest Service
New
AI / LLM Security

AI & LLM Penetration Testing Methodology

Our emerging AI security methodology covering prompt injection, model inversion, adversarial inputs, RAG poisoning, agent abuse, and LLM-specific attack vectors aligned with OWASP LLM Top 10.

  • OWASP LLM Top 10
  • Prompt Injection & Jailbreaking
  • RAG & Agent Security
  • Model Supply Chain
PDF 209 KB April 2026
Download PDF View AI Agent Pentest Service
ATM / Embedded

ATM & Kiosk Penetration Testing Methodology

Physical and logical security assessment methodology for ATM networks, cash kiosks, and embedded payment systems covering network isolation, XFS protocol, jackpotting resistance, and physical tamper testing.

  • XFS / CEN Protocol
  • Physical Tamper Testing
  • Network Isolation Review
  • Anti-Skimming Assessment
PDF 211 KB April 2026
Download PDF View ATM Pentest Service

All documents are free to download. No email required. Need a custom methodology or NDA-gated version? Contact us.

Questions & Answers

Methodology FAQs

Direct answers about testing frameworks, scoping parameters, rules of engagement, and auditor deliverables.

Our offensive testing methodologies align directly with authoritative industry standards: OWASP Top 10, OWASP ASVS (Application Security Verification Standard), and OWASP MASVS for mobile; PTES (Penetration Testing Execution Standard); NIST SP 800-115; and MITRE ATT&CK for red teaming and adversary simulation. Reports map directly to compliance controls including SOC 2 (CC4/CC7), PCI DSS 11.4, HIPAA §164.308, ISO 27001 A.8.8, and DORA.

Black Box: Zero-knowledge testing simulating an external attacker probing internet-facing assets without accounts or architectural blueprints.

Gray Box (Recommended): Credentialed testing simulating an authenticated user, tenant, or malicious insider. This maximizes ROI by bypassing basic perimeter login forms to test complex business logic, role segregation, and authorization boundaries (BOLA/IDOR).

White Box: Full-knowledge testing with access to source code repositories, architectural diagrams, and API schemas to eliminate blind spots.

Every finding delivered by Lorikeet Security is manually discovered, verified, and weaponized into a deterministic proof-of-concept (PoC) exploit by our senior offensive researchers. We never dump automated scanner results into a report. If a vulnerability appears in your report, it has been demonstrated to have real-world impact with clear developer-ready reproduction steps.

Yes. Free retesting within 30 to 60 days is included on every engagement scope. After your developers deploy security patches, our offensive researchers verify each fix to ensure the vulnerability has been completely eliminated without introducing regressions. We then issue an updated, clean final report ready for SOC 2 CPAs, PCI QSAs, or enterprise customer review.

Yes. We routinely test live production systems for fintech, healthcare, and SaaS companies. We establish clear Rules of Engagement (RoE), use non-destructive payloads, assign dedicated testing tenant accounts, throttle scanner velocity, and maintain direct Slack/Teams deconfliction channels with your engineering leads. Staging or UAT testing is also available if preferred.

Ready to Strengthen Your Security Posture?

Tell us about your environment and we'll recommend the right methodology for your needs.

Get a Quote View All Services Book a Call
Lory waving

Hi, I'm Lory! Need help finding the right service? Click to chat!