The Modern Penetration Testing Platform Built for Speed & Compliance.
Grade: B — Score: 70/100
Talon leverages advanced technology to provide real-time vulnerability findings, utilizing certified security experts and Lory AI for autonomous testing. The platform integrates seamlessly with existing development workflows, allowing for immediate retesting and remediation verification.
With a focus on continuous penetration testing as a service (PTaaS), Talon replaces traditional methods with a collaborative security operations platform that eliminates stale data and lengthy reporting processes. Users can interact directly with testers and receive live updates on their security posture.
By addressing risks proactively, Talon helps organizations maintain compliance with various standards such as SOC 2, ISO 27001, and PCI DSS. This approach not only enhances security but also streamlines the audit process, ensuring that organizations are always prepared for compliance assessments.
Lory Pay-As-You-Go Credits: US$1 per credit; prepaid loads from US$25, excluding applicable taxes
Lory Recon: US$250/month, excluding applicable taxes
Lory Operator: US$1,000/month, excluding applicable taxes
Lory Continuous: US$2,500/month, excluding applicable taxes
Talon PTaaS Essentials: US$1,999 billed annually, excluding applicable taxes
Talon PTaaS Professional: US$5,999 billed annually, excluding applicable taxes
Talon PTaaS Enterprise: US$9,999 billed annually, excluding applicable taxes
Talon PTaaS Enterprise Custom: Custom quote; no public fixed price
Human-led pentest engagement: Scoped quote; published service starting prices vary by assessment
Consider switching to Cymulate: Cymulate offers similar continuous testing features but lacks the same level of integration with developer tools.
Lorikeet documents human approval before Lory findings are released to Talon customers. That approval concerns findings and severity, not every action the AI takes during testing. It does not establish zero false positives.
Talon documents reports and compliance mappings that can support an audit. Lorikeet's Terms of Service say its reports do not guarantee compliance, despite stronger acceptance claims on the product page. Confirm the proposed scope and deliverables with your auditor before commissioning work.
You request verification after remediating a finding. Essentials lists unlimited automated rescans, while Professional lists unlimited human-reviewed retest verification. Separately scoped human engagements follow the retest window in the Statement of Work, and credit-funded Lory retests use your balance. Confirm the allowance and response time attached to your purchase.
Lorikeet states that client data is not used to train its own models or its providers' models. Lory still sends prompt content and engagement context to third-party providers for inference in the United States. Provider log retention is governed by Lorikeet's provider agreements, so no training does not mean no processing or storage.
Lorikeet's AI Usage Policy says Lory currently has no self-hosted or air-gapped deployment. An internal-network connector provides access for testing but does not turn Lory into an on-premises AI service. Buyers unable to permit third-party model processing should discuss Lorikeet's documented human-only engagement option.
You must own the targets or hold written authorization, and agree permitted actions and credentials. Cloud checks need a target asset or audit access, mobile checks need application or endpoint access, and source analysis needs a connected repository. Internal networks require the Lory Mesh connector. Lorikeet staff approve engagement starts, but individual AI actions do not each require human approval, so agree the scope and stop procedure before testing.
Lorikeet documents Jira, GitHub, GitLab and Azure DevOps work items, messaging connections and MCP access. Listed workspace integrations and custom webhooks are documented across plans without additional connector licensing fees. Webhook signing supports an optional shared secret, and failed deliveries are logged without an automatic replay queue.
Talon documents PDF deliverables and API export, with JSON and CSV export described in its knowledge base. Owning the engagement deliverables does not remove the Terms of Service's limits on third-party sharing. Confirm the required export format and access period before ending your engagement.