Talon — Independent Software Review

The Modern Penetration Testing Platform Built for Speed & Compliance.

Compliance Transparency Index

Grade: C — Score: 65/100

Best For

• Teams purchasing Lorikeet-led testing and wanting findings, remediation and reports in one portal
• Engineering teams that want human-reviewed findings delivered into their existing development workflow
• Buyers evaluating usage-based AI testing who can agree scope, data handling and spending limits

Not Ideal For

• Teams requiring a self-hosted or air-gapped AI tester, which Lorikeet's policy says is unavailable
• Buyers requiring confirmed autonomous mobile, cloud-configuration or repository testing before evaluation
• Procurement teams needing consistent public subscription, webhook and retention terms without clarification

Operational Overview

Pricing Structure

Lory Credits: US$1 per credit; prepaid loads from US$25, excluding applicable taxes

• Usage-based Lory testing inside Talon
• MCP tool calls cost 0.1 credit each
• Engagement charges depend on tokens, compute and testing depth

Lory Recon: Advertised at US$250/month, excluding applicable taxes; availability needs confirmation

• 275 credits each month on the pricing page
• Advertised unused-credit rollover
• Other current documentation says Lory has no monthly plans

Lory Operator: Advertised at US$1,000/month, excluding applicable taxes; availability needs confirmation

• 1,150 credits each month on the pricing page
• Advertised unused-credit rollover
• Other current documentation says Lory has no monthly plans

Lory Continuous: Advertised at US$2,500/month, excluding applicable taxes; availability needs confirmation

• 3,000 credits each month on the pricing page
• Advertised unused-credit rollover
• Other current documentation says Lory has no monthly plans

Human-led pentest engagement: Scoped quote; fees agreed in the Statement of Work

• Portal access and findings
• Agreed report deliverables
• Retesting within the contracted window

Offensive Security: Standard rate US$36,000 billed annually; scope can change the quote; taxes extra

• Two web application pentests, one network pentest and one API assessment
• 160 testing hours and 24 retesting hours per year
• Lory included; credit allowance not established

Defensive Security: Standard rate US$54,000 billed annually; scope can change the quote; taxes extra

• SOC, SIEM and EDR services
• Incident-response retainer
• Lory included; service limits and credits need scoping

Compliance Package: Standard rate US$27,600 billed annually; scope can change the quote; taxes extra

• Compliance-scoped pentest and readiness work
• 80 testing hours and 16 retesting hours per year
• Vanta or Drata is an optional separately priced add-on

Alternative Consideration

Consider switching to Cymulate: Cymulate offers similar continuous testing features but lacks the same level of integration with developer tools.

Frequently Asked Questions

Does Talon use human pentesters to review AI findings?

Lorikeet documents human approval before Lory findings are released to Talon customers. That approval concerns findings and severity, not every action the AI takes during testing. It does not establish zero false positives.

Can a Talon report support a SOC 2 or ISO 27001 audit?

Talon documents reports and compliance mappings that can support an audit. Lorikeet's Terms of Service say its reports do not guarantee compliance, despite stronger acceptance claims on the product page. Confirm the proposed scope and deliverables with your auditor before commissioning work.

How do retests work in Talon?

You mark a finding ready for retest after remediation, and Lorikeet verifies the fix. Human-led engagement retesting is governed by the window in the Statement of Work, while Lory documentation describes retesting against your credit balance. Confirm which allowance applies to your engagement.

Does Talon use customer findings to train AI models?

Lorikeet states that client data is not used to train its own models or its providers' models. Lory still sends prompt content and engagement context to third-party providers for inference in the United States. Provider log retention is governed by Lorikeet's provider agreements, so no training does not mean no processing or storage.

Can Talon provide self-hosted or air-gapped Lory testing?

Lorikeet's AI Usage Policy says Lory currently has no self-hosted or air-gapped deployment. An internal-network connector provides access for testing but does not turn Lory into an on-premises AI service. Buyers unable to permit third-party model processing should discuss Lorikeet's documented human-only engagement option.

What scope and access must we agree before using Talon?

You must own the targets or have written testing authorization, and define the permitted scope and credentials. Internal Lory testing needs a connector inside the network, while external testing does not need that connector. The AI Usage Policy says staff approve starts and some actions run without individual human approval; agree permitted actions and the stop procedure before testing.

Can Talon send findings to Jira and other development tools?

Lorikeet documents Jira, GitHub, GitLab and Azure DevOps work items, messaging connections and MCP access. Custom-webhook eligibility needs confirmation because the marketplace describes access without an extra tier while developer documentation requires Professional or above. The marketplace also says failed deliveries are logged without an automatic replay queue.

Can we export Talon findings for our own reporting?

Talon documents PDF deliverables and API export, with JSON and CSV export described in its knowledge base. Owning the engagement deliverables does not remove the Terms of Service's limits on third-party sharing. Confirm the required export format and access period before ending your engagement.

AI Visibility Report

How AI agents (ChatGPT, Perplexity, Claude, others) read this review page in the past 7 days. Updated weekly. View Talon AI Visibility Report.