Section 01 · Public Positioning
How Bishop Fox positions publicly
Bishop Fox markets itself as an offensive security firm anchored by Cosmos, its continuous attack-surface management product. The brand pairs a respected research team (Bishop Fox Labs) with a large consulting bench and, per its own announcements, a growth-equity investment behind the platform push.
Section 02 · Market Read
Where Bishop Fox actually plays
Bishop Fox is best understood as two products sold under one logo. Cosmos is a continuous external attack-surface monitoring platform billed on a subscription basis. The consulting practice runs scoped engagements (web, cloud, red team) at premium day rates. Cosmos is where the platform investment is going; the bespoke pentest line still exists, but the company's growth story is the product.
Section 03 · Where We Fit
Where Alacrinet sits next to them
We are not a Cosmos competitor. Cosmos and a deep manual pentest are different jobs. If you want continuous monitoring that alerts you when a new subdomain appears on your perimeter, Cosmos is that. If you want a senior operator chaining auth bypass into IAM abuse into a credible business-impact narrative, that is what we sell, and we sell only that. The honest read: if you already own Cosmos, you may still need us for the deep manual work; if you do not own Cosmos and were going to buy it for the testing line, talk to us first.
Section 04 · Side By Side
Side by side, on the dimensions that actually separate us
| Dimension | Alacrinet | Bishop Fox |
|---|---|---|
| 01 Center of gravity | Manual offensive testing as the entire business. | Cosmos (CASM platform) plus consulting; platform is the growth story. |
| 02 How you are sold to | Bailey scopes the engagement on the first call. | Sales engineer scopes; delivery operators assigned after signature. |
| 03 What the recurring contract looks like | Engagement-based, scoped to the question, no platform seat fee. | Cosmos subscription plus separate consulting SOWs. |
| 04 Retest | Unlimited and untimed on every engagement. | Cosmos retests on its own cadence; consulting retests scoped per SOW. |
| 05 Artifact retention | Client testing artifacts destroyed within 30 days, written attestation. | Cosmos retains findings as part of the platform; standard MSA terms otherwise. |
Section 05 · Buyer-Side Honesty
When each firm is the right pick
When Bishop Fox is the right pick
- You want continuous external attack-surface monitoring as a product, with alerting tied to a SaaS workflow.
- You need a household brand on the report cover for a board or insurer who already knows the Bishop Fox name.
- Your scope is large enough that platform plus engagement makes commercial sense and you have the budget for both line items.
When Alacrinet is the right pick
- You want the named operator on every call, including the scoping call and the executive readout.
- You do not want a platform subscription bundled into a testing relationship.
- You want unlimited retest with no time cap, written into the SOW rather than offered as a courtesy.
- You want client artifacts destroyed rather than retained inside a product surface.
Section 06 · The Tiebreaker
How to decide without a bake-off
Send the twelve-question checklist to both firms and require written answers in the proposal. The answers will sort the fit faster than a demo or a sample report. If Bishop Fox is the right call for your scope, the checklist will say so. If we are, the same checklist will say that too.
Section 07 · Frequently Asked
Frequently asked questions
Q1 Is Cosmos a substitute for a pentest?
No, and Bishop Fox would say the same. Continuous external monitoring catches new exposure on your perimeter; a manual pentest finds the chained business-logic and auth abuses that a scanner never reaches.
Q2 Can you scope the same kinds of engagements Bishop Fox does?
For web, cloud, API, internal, and red team, yes. For continuous CASM as a product, no. We are a service firm, not a platform vendor.
Q3 Is the price difference meaningful?
Usually. Once you strip out the Cosmos seat fee and the platform overhead, a comparable standalone engagement tends to come in well below a platform-plus-consulting bundle, without compromising operator seniority. The exact gap depends on scope, so we will put both numbers in writing.