Lory by Lorikeet

Lorikeet Lory is an AI-assisted penetration testing service that conducts full security engagements from scoping through to a signed report, with a human pentester countersigning every finding before delivery. How it works: - The customer declares targets and signs a rules of engagement document via a portal - Lory performs automated recon, selects attack vectors, executes them, validates findings, and drafts reports - Every tool call is checked against the signed scope before execution; out-of-scope targets are never contacted - All findings remain in a pending state until a Lorikeet human pentester reviews, rates risk, and countersigns - The final report is issued on Lorikeet letterhead and is accepted by SOC 2 and ISO 27001 auditors Engagement types supported: - Web application and API testing - External and internal network testing (via mesh connector) - Cloud environments (AWS, Azure, GCP, Kubernetes, containers, serverless) - Mobile applications (iOS and Android) - Source code and software supply chain review - Physical security (human-led only, not run by Lory) Deliverables per engagement: - Executive summary with CVSS-rated findings and remediation guidance - Control mappings to SOC 2 Trust Service Criteria, ISO 27001 Annex A, PCI-DSS, HIPAA, CMMC, GLBA, and CIS - Proof of exploitation per finding (request/response, screenshots, attack chains) - Coverage record listing vectors planned, executed, and skipped with reasons - Retest capability against existing credit balance without a new statement of work - Machine-readable export in SARIF 2.1.0 format and via MCP Pricing uses a prepaid credits model with no per-seat or subscription fees. Quotes are returned within 24 hours of scope submission, and recon begins the same day the scope is signed. Three depth levels are available: Surface, Standard, and Deep.