Alexandra leads Growth & Community at Escape and hosts The Elephant in AppSec podcast, focusing on application security. She’s active in BSides Amsterdam, OWASP AppSec Days, and contributes security research featured in outlets like Help Net Security
API Security
Escape is the leading Burp Suite alternative for modern application security teams. Unlike Burp Suite, Escape automates business logic testing (IDORs, SSRFs, access control flaws), ensures faster scanning with fewer false positives, and provides remediation code snippets.
![[Webinar] Doing More With Less: How Security Teams Escape Manual Work with Efficient Workflows](/blog/content/images/size/w600/format/webp/2026/01/automate-manual-workflows-security.png)
Webinar
Security teams are under constant pressure to do more with the same resources. Manual processes, fragmented tools, and inefficient workflows can slow teams down and pull focus away from what matters most. In this live webinar, experienced security practitioners share how they’ve escaped the constraints of limited resources by rethinking internal workflows, reducing repetitive tasks, and focusing their effort where it matters most. Feeling the pressure to do more with less? Then, this session i
Application Security
Learn about the key differences between DAST and pentesting, the emerging role of AI pentesting, their roles in security testing, and which is right for your business.
Product updates
How to Visualize Web & API Coverage and Validate Attack Path in Escape DAST
API Security
When it comes to securing applications and APIs, the best API security testing tools are indispensable. These advanced solutions detect vulnerabilities by continuously scanning for weaknesses and simulating real-world attacks. But how do you choose between all API security testing vendors? Agentless API security tools are transforming application security by overcoming the pitfalls of traffic-based solutions like Noname security (part of Akamai) or Salt Security, which burden teams with long s
Pentesting
Explore the best web application penetration testing tools of 2026. Learn how modern pentesting solutions detect business logic flaws and scale continuous security testing, so security teams can support modern web apps with faster, more accurate coverage.
Application Security
Escape ASM (Attack Surface Management) now natively supports the discovery and external scanning of unauthenticated MCP (Model Context Protocol) endpoints, extending discovery coverage to a new generation of AI-native APIs and LLM infrastructure. As organizations increasingly adopt MCP to connect large language models (LLMs) with tools, data sources, and internal services, new externally exposed attack surfaces are emerging, often without clear visibility or security controls. This update brin
Competitor Comparison
Explore how Bright Security differs from Escape, weigh the advantages and disadvantages of both, and determine the best fit for your company.
DAST
Discover an in-depth overview of the top 11 DAST tools for 2026, reviewed for APIs, SPAs, and CI/CD pipelines. Compare strengths, weaknesses, and key features that matter to AppSec and DevSecOps teams.
Application Security
On November 4, 2025, Apple shipped its redesigned App Store website. However, it came with a surprise: JavaScript sourcemaps enabled in production. Within hours, it enabled some to download Apple’s entire front-end codebase directly from the production site. They used a Chrome extension to extract and save all the available resources from the web App Store, and decided to archive them on GitHub for educational purposes. Here's why we're talking about it: with Escape DAST, we've found this exact
Application Security
Explore Duck Store, a modern, intentionally vulnerable web app designed for security testing.
Product updates
Assign the assets to the right project, add the right people, and let them start reviewing findings and patching what needs to be patched.
Pentesting
Explore the best Agentic pentesting tools of 2026. Learn how modern pentesting solutions detect business logic flaws and scale continuous security testing, so security teams can replace manual pentests with faster, more accurate coverage.
Application Security
Two exciting updates in the Elephant in AppSec corner! 1. The Elephant in AppSec Conference 2026 Agenda Is Now Live The agenda for the 2026 edition of The Elephant in AppSec Conference is officially published. This year’s program brings together a lineup of speakers who aren’t afraid to challenge assumptions and share strong, sometimes controversial perspectives on the state of application security. From DevSecOps and security culture shifts to the rising influence of Agentic AI across all a
Product updates
Discover the latest features we’ve shipped, from multi-tenant testing to enhanced scan failure visibility!
Pentesting
Explore this complete guide to agentic pentesting and learn how agentic pentesting architecture works, the key benefits it delivers, and the tools you can integrate into your security workflow.
Pentesting
Explore the best AI pentesting tools in 2026. Learn how modern pentesting solutions detect business logic flaws and scale continuous security testing, so security teams can replace manual pentests with faster, more accurate coverage. Updated: August 2026
Product updates
Until now, custom rules in Escape were limited to single-request vulnerabilities. You could only define and test one request at a time. This meant that more complex vulnerabilities, such as those requiring multiple chained steps (e.g., creating a user, then editing that user to escalate privileges), couldn’t be implemented. That changes today. 💡TL;DR: Escape now supports multi-step custom rules. You can chain requests, extract and transform data (tokens, IDs, etc.), and reinject it into subs
![[Webinar] Automating Offensive Security with AI: A Guide to Scaling Pentesting with Escape](/blog/content/images/size/w600/format/webp/2025/11/webinar-automated-pentesting-guide--1-.png)
Automated pentesting is now one of the most hyped topics in cybersecurity, with AI systems promising to replace human hackers. But how much is real, and how much is marketing hype? This webinar provides a practical guide to automating offensive security, built from the perspective of offensive and application security leaders we worked with who’ve spent years pushing the boundaries of what can (and can’t) be automated. We've often heard: "I have only 15 minutes to manually test each new featur
Case Study
In a recent webinar on "From Business Logic Vulnerabilities to Actionable Insights: AI-powered Pentesting + ASM in Action," Andrew Orr Erwing, Manager of Security Engineering (AppSec) at Applied Systems, shared his team's journey in modernizing their application security approach. For organizations that have grown rapidly through acquisitions, application security can become a labyrinth of complexity. Applied Systems found themselves facing this exact challenge—a sprawling tech infrastructure w
Research
Hey there, With Halloween around the corner, what’s scarier for organizations than vulnerabilities in their web applications? And it's even scarier when the development of these applications is in the hands of users not familiar with security practices. This year, the Escape research team has focused on a growing area of concern: vibe-coded applications. Purpose-built platforms like Lovable.dev, Base44.com, and Create.xyz have democratized application development, enabling non-developers to d
Competitor Comparison
Looking for a Detectify alternative? Compare Escape vs Detectify on API and app security, pricing, G2 ratings, and key features. See why security teams choose this application security scanner for business logic testing and internal app scanning.
Attack Surface Management
When I launched this research, my goal was to understand the current perception of security practitioners regarding Attack Surface Management (ASM) solutions. Unlike in my previous article, "What is wrong with the current state of DAST?" I didn't start with an overall negative perception from the security practitioners. I was just generally curious and asked quite open-ended questions to see if anyone even had strong opinions on ASM (some didn’t!). One key takeaway from the DAST research was th
Product updates
Security teams know that finding a vulnerability is only half the battle. The harder part is validating that it can be exploited and applying the right fix with confidence. Too often, remediation guidance is static, generic, or incomplete, leaving engineers guessing. This also strains the relationships between security and developers. As a result, vulnerable applications stay longer exposed to attackers. That’s why we’re introducing AI-powered proof of exploit and remediation guidelines. It sho
