AI Can’t Pentest Runtime: Why Lorikeet Prioritizes Human Offensive Security
When AI cleans the codebase, reality still bites
You know the drill — your CI pipeline blares green, your AI assistant autocorrected the insecure crypto call, and the developer who pushed at 2 a.m. got a polite suggestion from Copilot. Then a month later the SOC stack lights up because a reverse proxy header leak and a TLS runtime quirk let session tokens be replayed. That exact frustration is the starting point for Lorikeet Security: a PTaaS-first offensive firm built for teams that already lean on AI during development. At its core: manual web, API, network, mobile, and cloud pentests; continuous Attack Surface Management; vCISO and SOC-as-a-Service — all surfaced in a portal with live findings, real-time chat, and integrated reporting. Their ethos is simple: AI closes classically easy source-level holes, but the remaining risk lives in runtime, infra, and configuration — where humans still win.
Architecture & Design Principles
Lorikeet’s platform reads like a modern security service blueprint: API-first PTaaS with a single-page frontend and event-driven backend that ties human analysts to automated tooling. The portal likely uses websockets or a real-time message bus to push findings and chat updates, while backend workers (containerized) run scanners, orchestration hooks, and post-processing jobs. Design decisions emphasize separation of concern — triage and reporting are decoupled from test execution — so you can scale concurrent engagements without slowing the analyst workflow. For scalability, expect stateless workers, autoscaling test runners, and a central, encrypted store (audit logs, evidence artifacts) that supports compliance exports. The philosophy: make manual testing fast, repeatable, and auditable in an AI-native software lifecycle.
Feature Breakdown
Core Capabilities
- ▸
Feature 1: Manual pentesting across stacks — web, API, mobile, network, cloud
Technical explanation + use case: Analyst-driven assessments use handcrafted attack chains, runtime instrumentation, and live exploit validation. Use case: post-AI-code audit verification where SAST/IAST/AI auditors closed code-level flaws but runtime auth or proxy logic needs human exploration. - ▸
Feature 2: Continuous Attack Surface Management (ASM)
Technical explanation + use case: Periodic discovery sweeps and passive monitoring map exposed endpoints, DNS, cert posture, and cloud misconfigurations. Use case: teams with dynamic infra (auto-scaling services, ephemeral environments) who need rolling inventory and prioritized risk alerts. - ▸
Feature 3: PTaaS portal with live findings and chat
Technical explanation + use case: Real-time delivery of evidence (POCs, request logs, screenshots) via a reactive UI plus embedded analyst chat for clarifications and live retests. Use case: product/security teams that want asynchronous, actionable tests integrated into their sprint cadence.
Integration Ecosystem
Lorikeet positions itself to plug into developer workflows: API endpoints and webhooks for findings and issue creation, SSO (SAML/OAuth) for enterprise onboarding, and connectors to issue trackers and chatops tools. Cloud connectors (read-only IAM roles) enable safe discovery and targeted testing in AWS/GCP/Azure. The practical result: findings show up in your backlog with repro steps and you can trigger retests without a dozen emails.
Security & Compliance
Data handling is built around least privilege and auditability: encrypted transit and at-rest storage for evidence, RBAC in the portal, and scoped credential usage or ephemeral tokens for testing. Lorikeet offers testing aligned to SOC 2, HIPAA, PCI-DSS, HITRUST, and FedRAMP needs — delivering artifacts and executive reports that map directly to controls auditors expect.
Performance Considerations
Human-led tests are inherently latency-bound — quality beats raw throughput — but the platform optimizes for speed: parallel worker pools for automated scans, prioritization queues for high-severity engagements, and real-time updates to reduce handoff friction. Resource usage is modest on the portal side; the heavier load sits in ephemeral scanners and evidence storage, which can be autoscaled and pruned to control cost.
How It Compares Technically
Compared to crowdsourced platforms like Bugcrowd or Synack, Lorikeet offers a more curated, practitioner-centric experience with deeper manual validation rather than wide-net bug hunting. Against automated SAST/DAST vendors like Snyk, Veracode, or Detectify, Lorikeet doubles down on runtime and infra — the residual risk after AI-assisted code reviews. My hot take: AI + SAST narrows the attack surface; boutique PTaaS firms that know to hunt runtime, proxy, and TLS edge cases deliver disproportionate value.
Developer Experience
The UX is built for engineers: actionable tickets, reproducible PoCs, and chat-driven clarifications. API-first design and webhooks let you automate ticket creation and trigger retests from CI. Documentation and SDK surface area tends to be pragmatic — expect clear API docs and examples in Python/JS — but community support will be boutique, not broad like an open-source tool. For product teams, the tradeoff is human expertise for tailored remediation guidance.
Technical Verdict
Lorikeet Security’s stack is optimized for the post-AI world: fast, auditable manual testing wrapped in a modern PTaaS experience. Strengths: deep runtime and infra expertise, real-time remediation workflows, and compliance-aligned reporting. Limitations: human pentests cost and cadence can’t match continuous automated tools for sheer volume, and boutique firms provide less of the community-driven tooling you’d get from larger platforms. Ideal use cases: AI-native SaaS, fintech, healthcare, and high-compliance startups who need practitioner validation after automated audits — especially when the risks live in session management, TLS posture, file-system hygiene, or reverse-proxy headers (exactly the gaps Flowtriq’s case showed). My recommendation: treat AI audits as your first layer, then book focused, hypothesis-driven pentests that hunt the runtime and infra edges AI can’t see.