Strengths
Cautions
Learn More
Escape combines business-logic-aware DAST with agentic AI penetration testing. We think it is a strong fit for security teams supporting large engineering organizations, and it covers ground other scanners do not.
1. Expert Insights Verdict
Escape is an offensive security platform built around two testing layers: business-logic-aware DAST that runs on every release, and agentic AI penetration testing for complex, multi-step attack chains. Escape is aimed at mid-market and enterprise organizations with a central security team and highly distributed engineering. Its real strength is authorization testing, holding several user identities at once to check whether one user can reach another’s data across tenants, which most DAST tools cannot do.
2. Fast Facts
- Headquarters:NY, US. Engineering and product in Europe, go-to-market largely in the US
- Founded: 2020, with the first product shipping in 2022
- Ownership: Private, venture-backed
- Funding: $18m Series A announced 10 March 2026, led by Balderton Capital with Uncorrelated Ventures, IRIS, and Y Combinator. Approximately $24m raised in total
- Employees: Around 50 (vendor-provided, August 2026)
- Scale: More than 2,000 customers across Europe and the US (vendor-provided, August 2026)
- Security and compliance: SOC 2 Type II
3. Escape’s Approach
Escape’s key argument is that traditional dynamic testing cannot find the vulnerabilities that matter most in modern applications. A scanner that injects payloads and matches responses against known signatures can find injection and misconfiguration. But cannot answer whether one tenant’s user can read another tenant’s order, because that is a question about how the application is supposed to behave, not about what strings it reflects.
Escape’s answer is to model the application first and test its logic second. That principle runs through both products: Cascade, an agentic penetration testing system built for chained, multi-step attacks and a DAST engine that runs continuously against every release.
Cascade (AI pentesting)
Cascade is a multi-agent system rather than a single model pointed at a target. An orchestrator plans the engagement and spawns specialist agents on demand, so the shape of an assessment follows what the application turns out to be rather than a fixed script. A coverage agent hunts for surface that has not been tested. A reporter agent independently reproduces every candidate finding on the live target before it is filed, which is the step that separates a proven attack chain from a plausible one.
The system also retains context between engagements. It holds what it has learned about your user roles, which services handle payments, and where sensitive data sits, so each assessment builds on the last rather than starting cold. Existing bug bounty submissions and manual pentest reports can be ingested as further context.
Escape’s own position is that agentic penetration testing is what customers should be prioritizing, and its product investment reflects that.
The DAST engine
The engine was built in-house. It is based on Feedback-Driven Semantic API Exploration, a reinforcement learning approach from Microsoft’s REST-ler research, which Escape rebuilt for modern APIs and CI/CD timescales. Any API, whether REST or GraphQL, is parsed into a technology-agnostic graph of resources and resolvers.
Machine learning then infers the relationships the specification does not state, such as which returned field feeds which parameter, and strongly types every field across more than 800 data types, 300 of them critically sensitive. From there the engine iteratively learns to generate legitimate traffic, and the security tests run as middleware over that exploration.
How the two layers work together
The layers are designed to feed each other. A flaw Cascade proves once is converted into a custom regression test inside the DAST engine, so it is re-checked on every subsequent build. The expensive, deep testing happens once; the cheap, continuous testing makes sure the fix holds.
4. Market Position
Escape competes in two adjacent markets. On DAST, it sits alongside Bright Security, StackHawk, and Invicti. Its argument against all three is architectural. Those tools generate payloads and match responses, which finds injection and misconfiguration well, whereas Escape models the application first and then tests whether its authorization logic holds.
Multi-user testing is the clearest expression of that difference: Escape runs several authenticated identities at once to check whether one can reach another’s data, and says the others have no equivalent. It makes the same case against Rapid7 and Qualys, adding that those tools struggle with modern JavaScript and React front ends.
On AI penetration testing it competes with XBOW and Aikido, and here the differentiation is Cascade retains context about your roles, data sensitivity, and business function between engagements.
Rather than starting cold each time, its reporter agent independently reproduces every finding before filing it, and anything it proves converts into a regression test so coverage compounds instead of resetting. Escape’s own benchmarking, run against the same open-source targets used in an independent Doyensec comparative study, places Cascade ahead of both on total findings. Worth noting that the study itself points out the tools compared do not share a definition of critical severity, so treat the totals as indicative rather than settled.
Escape’s commercial positioning is important to highlight. Where several AI-driven competitors charge by token consumption, Escape charges per test for penetration testing and per application for DAST. The argument is that token pricing caps how much testing you can afford to run, which defeats the purpose of continuous assessment.
It is also important to understand Escape does not replace static analysis or software composition analysis. It is not a runtime protection product either: it will prove what an attacker could exploit, but it will not block an attack against production traffic. Organizations needing both will run it alongside a runtime tool. Attack surface management is now the company’s oldest product and is generally sold bundled with DAST orAI pentesting rather than as a standalone solution.
5. Key Features and Use Cases
Replacing or supplementing manual pentest cycles
Most organizations are blind between scheduled engagements. Because Cascade retains context about your environment across assessments — your user roles, which services handle payments, where sensitive data sits — it is not re-learning your application every time. Existing bug bounty submissions and manual pentest reports can be ingested as further context.
Escape supports both black-box and white-box testing but recommends black box, arguing that the difference in results is modest on their engine and that black box better reflects what an attacker without insider access could achieve. White-box testing requires uploading the repository as an archive. Escape’s GitHub integration covers attack surface management and CI-triggered scans rather than white-box AI pentesting. Model selection is handled entirely by Escape, with no option to supply your own model provider or API keys.
Pricing is per test rather than per token, which is the mechanism that makes running it continuously affordable rather than something you ration.
Seeing what was tested, and what was proved
Cascade’s reasoning is visible while the assessment runs rather than summarized afterwards. You can follow which routes are being explored and ask the agent directly what it failed to reach. Every candidate finding is independently reproduced by a separate reporter agent on the live target before it is filed, so what arrives has been demonstrated rather than inferred. Findings are presented as attack chains with business impact, technical detail, and a reproducible path, each carrying execution logs and screenshots. At the end of an assessment, a coverage overview lists every route and page tested, which lets a security team argue about scope on evidence rather than assertion Anything Cascade proves converts into a permanent regression test inside the DAST engine.
Testing authorization across users and tenants
Escape holds several user identities at the same time, each in an isolated session, and checks which of them can reach a given endpoint. In a healthcare application with admin, doctor, and patient roles, that means verifying a patient cannot retrieve another patient’s records, and that an admin can.
Roles and expected permissions are described in natural language rather than configured as rules. The results view shows, per endpoint, which user authenticated successfully and which was correctly refused, with a screenshot captured at each step as evidence.
Before testing begins, Escape crawls the application separately as each persona, so it has a picture of what every privilege level can legitimately reach before it judges whether an access control has failed. Coverage is shown per persona in the console. Each finding carries a confidence rating in its explanation, and a reviewer can open the underlying request log to see which identity authenticated, confirm whether the behavior was intended, and validate or refuse the finding. Those decisions feed back into the engine.
Escape reports that adding a second user account typically uncovers 30 to 50% more issues, which is a useful indication of how much of this flaw class single-identity scanning misses.
Continuous testing that satisfies compliance
Escape’s business-logic-aware DAST runs inside CI/CD, triggering on every push, with gates that do not require the security team in the loop. Scan profiles can be scheduled, rate limited, restricted by duration, or set to crawl-only where you need coverage without altering application state.
Compliance reporting is generated per framework, currently covering OWASP, SOC 2, ISO 27001, NIST, FedRAMP, NIS2, HIPAA, CRA, and MITRE ATT&CK, each with a pass or fail breakdown against every tested control.
Customers can pass these reports to their own clients during procurement as evidence of testing, so the reporting is doing commercial work as well as audit work.
Getting fixes into the developer’s workflow
Escape detects the framework an application is built on and generates remediation as code for that specific stack, whether that is React, Django, or Spring Boot, rather than pointing at a general guideline. Each finding carries the request chain that produced it, an exploration graph, and a screenshot, so the developer can see how the flaw was reached rather than being asked to trust a severity rating.
Findings can be opened directly in Claude Code, Codex, or Visual Studio Code through Escape’s MCP server, which matters as more remediation work happens inside AI coding assistants rather than in a ticket queue. Escape reports an 80% reduction in time to remediation against manual and semi-manual processes, and a false positive rate at or below 4%, which is the number that determines whether developers keep trusting a pipeline gate or start routing around it.
Finding shadow APIs and sensitive data
Agentless discovery builds an inventory of every REST and GraphQL API across the environment, including internal services and undocumented endpoints, then maps single-page applications and infrastructure alongside them.
Sensitive data detection runs over every response the engine sees, classifying values across more than 800 data types, of which more than 300 are treated as critically sensitive, covering secrets, tokens, and personal data. That classification happens dynamically during testing rather than only against the documented schema, which is how the engine surfaces data leakage that the specification gave no indication of.
Governing security across distributed or acquired estates
Escape’s projects model scopes assets by brand or team. A developer logging in sees only the issues belonging to their project, while the central security team gets a cross-brand view showing which teams carry the most risk and which newly acquired estate arrived with the largest backlog.
For this reason, Escape is a strong fit for organizations with a central security function and distributed engineering. Alerts are ranked by severity and can be sent to Slack, Jira, email, or any webhook. Escape was also the first DAST tool to support the Wiz integration, sending application findings into a wider risk picture.
6. User Experience
Setting up a DAST scan is straightforward. You choose whether the target is a web application or an API, enter the URL, and configure authentication. Escape drives a browser agent through your login form and confirms it can get in before the scan starts, and you can add natural language instructions for anything in the way, such as dismissing a cookie banner before signing in. Multi-factor authentication has to be disabled or configured separately, which is worth planning around.
Cascade works differently. You are not building a scan profile so much as commissioning an engagement, and the orchestrator decides what to spawn once it sees the application. The agent’s reasoning streams while the assessment runs, so you can follow which routes are being explored in real time and ask questions in-real time, rather than waiting for a report. When it finishes, the coverage overview lists every route and page reached, with logs and screenshots attached.
Once a DAST scan is running, the console detects your application framework automatically and uses it to generate remediation as code for that stack rather than a link to a guideline. Findings from either product can be opened directly in Claude Code, Codex, or Visual Studio Code through Escape’s MCP server. Workflows handle routing, with triggers on new issues, updated issues, or failed scans, conditions on severity and exposure, and actions out to Slack, Jira, email, or a webhook.
Escape is not a self-service product. Every customer is onboarded by a dedicated customer success manager. Some customers never open the console at all and drive everything through the public API and MCP server, but this is rare.
7. Pricing
Escape does not publish pricing, and there is no public rate card or calculator. The model is per application for DAST and per test for AI penetration testing. That is a deliberate contrast with competitors that charge by token consumption, and Escape’s argument is that token pricing effectively caps how much testing you can run before cost becomes a constraint.
The two products, DAST and AI pentesting, are sold individually or together as a platform, and attack surface management is normally bundled rather than bought alone. Which layer you start with tends to follow the use case: teams replacing a legacy scanner or meeting a compliance requirement start with DAST, while teams looking to reduce manual pentest spend start with Cascade.
8. Who It’s For
Escape is built for mid-market and enterprise organizations where engineering outnumbers security. If you are spending heavily on manual penetration testing, or you have no visibility into application risk between annual engagements, Escape’s AI pentesting product, Cascade, is a strong fit. It runs continuously, keeps what it learns between assessments, and reproduces findings before filing them, which is what makes an AI-driven engagement worth reading rather than worth triaging.
If your applications are modern JavaScript or React front ends over multi-tenant APIs, and your biggest exposure is a user reaching data they should not, Escape is a very strong fit. That flaw class is what both products are built to find.
If you run a central security team over distributed engineering, or you inherit application estates through acquisition, the projects model and cross-brand reporting are as valuable as the testing itself.
Which layer to start with
We recommend starting with Cascade if your problem is depth rather than frequency: you are spending heavily on manual engagements, or you are blind between annual pentests and want something running in the gap. It is priced per test and aimed at the complex, chained flaws the continuous layer will not reach.
We recommend starting with the business-logic-aware DAST if you are replacing a legacy scanner, need testing that runs on every release, or need documented evidence for an auditor or a customer’s procurement team. It is the continuous layer, it is priced per application, and Escape itself points buyers here when the requirement is a compliance result.
