Co-founder & CEO of Escape. In charge of Product, Sales, and Marketing. I was a dev before.
AI pentesting
Disclosure-to-exploit time is now hours, not weeks. Escape Continuous AI Pentesting tests only what each release changes, on every merge, deploy, or schedule. Attack paths are tailored from past reports and with OSCP certifications you can always stay audit-ready.
Compliance
Which compliance frameworks accept AI pentests? What are the differing requirements across frameworks and what do you need to fulfill them? This is your one-stop guide to being compliance ready before your next audit.
Led by Balderton Capital, with participation of Uncorrelated Ventures and existing investors IRIS and Y Combinator, the $18M Series A financing will accelerate our mission to multiply the impact of security teams through full-lifecycle offensive security.
API Security
We have been doing API Security wrong. Discover how the limitations of DAST API security tools might impact your security and why Escape's technology is the best way to protect your APIs.
API Security
We have been doing API Security wrong. Discover how the limitations of traffic-based API security tools might impact your security and why Escape's agentless technology is the best way to protect your APIs.
![[Webinar] How to secure GraphQL](/blog/content/images/size/w600/format/webp/2024/04/How-to-secure-GraphQL-webinar-2.png)
API Security
Join Uri Goldshtein and Tristan Kalos for a webinar on GraphQL security and learn to secure your GraphQL APIs.
API Security
In the last decade, security scanners have evolved to identify common vulnerabilities like SQL injections. But that’s just not enough anymore. In 2024, data leaks in applications come from exploiting business logic flaws. In the next few years, applications will grow in size and number too fast, so the true advantage will come from being able to find business logic vulnerabilities at scale. The growing diversity of security tools changed the way we secured our applications in recent years. Th
API Security
Explore the top 10 Spring Boot security best practices from the Escape team to secure your Java web applications efficiently.
API Security
Curious about the key strategies to ensure the security and reliability of your ASP.NET applications, including building APIs? Dive into our latest blog post, where we guide you through ASP.NET security best practices. Explore how these practices can not only enhance the security of your web applications but also bring tangible benefits to your development journey. In this guide, Escape's security research team has gathered 10 crucial ASP.NET security best practices that empower you to create m
Announcement
Today, we’re finally unveiling new capabilities of Escape - agentless discovery and inventory of APIs within their specific business context.
API Security
Are you looking to make your API security program stronger? Do you sometimes find it challenging to spot and address security vulnerabilities effectively? You're not alone! Many security professionals like you face challenges in improving API security because technology and cyber threats keep changing. This makes ensuring strong API security a complex but vital task. This checklist can help. You can use these guidelines to improve your API security posture. Feel free to adapt these guidelines t
API Security
After one year and a half of approaching API security through the lenses of GraphQL, we are proud to introduce full support for REST API Security Testing in Escape, in addition to GraphQL 🚀 You like us on GraphQL. You will love us on REST. It's been a ride since Escape's public release of our GraphQL security platform last September. To enrich this core capability, we have been shipping many new features since our public release: API Inventory, Posture Management, CI/CD Integrations, SSO, a
GraphQL
As developers, ensuring the security of our applications is crucial. Insecure Direct Object References (IDOR) are common security vulnerabilities that occur when a system's internal implementation is exposed to users, allowing them to manipulate references to access unauthorized data. GraphQL, a powerful data query and manipulation language for APIs, is not exempt from this vulnerability. In this blog post, we will dive in detail into what IDOR vulnerabilities are and why they pose a threat to G
You must have understood that GraphQL is a very powerful language! Indeed, it is the query language used by the world's largest social network: Facebook (they created it in 2012 and made it public in 2015). However, these benefits and power also come with added complexity. This complexity leads to several vulnerabilities. One of them is failure to Appropriately Rate-limit. In this article, we will focus on this problem. What is rate limiting? The principle of rate limiting the API is simple.
tl;dr we are releasing the biggest update of our GraphQL Security platform so far. It includes numerous new features, including API Posture management, Reporting Overview, Better CI/CD Integration, GitHub SSO, and OWASP API Top 10 2023 Support. Hello, Escape community! We are thrilled to announce the release of Escape v2, the result of months of intense work by the Escape team, driven by feedback from the community and our users. Our latest version is packed with exciting new features with a
Announcement
tl;dr we scanned 6031+ public APIs on the internet with our in-house feedback driven exploration tech and ranked them using security, performance, reliability, and design criteria. The results are public on APIrank.dev. You can also request to index your own API for free and see how it compares to others. Why APIrank? 🤔 During a YC meetup, I spoke with fellow founder Andrew Kim from Finex. He told me about their struggle to select the right API providers in his past companies. It's true tha
This post is a write-up of a talk I gave at the GraphQL San Francisco Conference. You can find the video on youtube. If you are in the bay area do not forget to also join the GraphQL SF group on meetup. It's commonly said that GraphQL is less secure than REST by default. As a company specialized in GraphQL Security, we have explored its security implications for more than a year on a wide range of production-grade endpoints. In this talk, we use data from our free tool GraphQL.Security to exp
Announcement
Find and fix vulnerabilities in your GraphQL applications — powered by Escape's AI-enhanced business logic testing for GraphQL.
Startup Security
Why should you care about security in a SaaS Startup? 1) To avoid expensive Data Leaks 🥷 A common misconception among startups is that only big corporations, or large scale-ups, are targeted by cyberattacks. Unfortunately, startups of all sizes can be targeted: from the 139 Million records leaked by Canva in 2020 to the 70 000 records leaked by start-up Mercato in 2019 before its Series A. According to a study by IBM, the average cost of a leak is 150$ per record. One can quickly imagine t
Startup Security
In Ukraine, web APIs have demonstrated their value to achieve democratic progress through e-governance. Nonetheless, API security has revealed its vital nature in light of the cyberattacks launched by Russian state-sponsored hackers.
DevSecOps
DevSecOps aims at integrating security inside the development process. It can be hard to know where to start. In this article, learn the best practices to implement DevSecOps in your engineering teams.
DevSecOps
This last part of the DevSecOps 101 series shows you how to scan your Docker images using Trivy, an open-source security scanner to find misconfigurations and vulnerabilities.
DevSecOps
This article is part of a series about integrating security tooling in the development process. You can find the rest of the articles here: * Part 1: Detecting Insecure Dependencies (SCA) * Part 2: Detecting Insecure Source Code (SAST) * Part 4: Scanning Docker Images With Trivy Note: This tutorial is based on the repository resulting from part 2. If you haven't achieved it yet, no worries! You can directly fetch the result from Github. If you already have done the two first parts of the tu
DevSecOps
In this tutorial, we will learn how to detect and fix vulnerable Python code using Semgrep.
