Search

Escape - Application Security & Offensive Security Blog

Explore practical offensive and application security insights covering web application testing, emerging AI cybersecurity research, API and GraphQL security, and advanced testing techniques.

Filters

ASP.NET security best practices

API Security

ASP.NET security best practices

Curious about the key strategies to ensure the security and reliability of your ASP.NET applications, including building APIs? Dive into our latest blog post, where we guide you through ASP.NET security best practices. Explore how these practices can not only enhance the security of your web applications but also bring tangible benefits to your development journey. In this guide, Escape's security research team has gathered 10 crucial ASP.NET security best practices that empower you to create m

Tristan Kalos

Tristan Kalos

7 min read

What’s new - Escape Product Updates

Product updates

What’s new - Escape Product Updates

Discover our latest product updates: support for Insomnia collections, WP-JSON schema, and additional business logic security tests. Plus you can now fully benefit from Escape's public API.

Alexandra Charikova

Alexandra Charikova

5 min read

What is business logic, and why it's important for application security

Application Security

What is business logic, and why it's important for application security

Is understanding business logic a critical component of application security? Absolutely. In the world of cybersecurity, business logic is more than just a set of operational directives. It serves as the crucial bridge between an application's technical function and its alignment with strategic business goals. More than that, it's important not only to understand but also to properly secure applications from business logic attacks. A striking example of this was the breach experienced by USPS,

Alexandra Charikova

Alexandra Charikova

6 min read

Webinar: Best Practices for Security Compliance

Webinar: Best Practices for Security Compliance

How can you turn compliance from a box-ticking exercise into a strategic advantage for your organization? Join our upcoming webinar with DevSecOps expert, Wilson Mar, and get insights you need to optimize your approach to security compliance. 😔Unfortunately, this webinar has been canceled until further notice. One of our hosts is facing a medical situation that requires immediate attention, and he will be undergoing a medical procedure tomorrow. It's unknown yet when he'll be out of recovery.

Alexandra Charikova

Alexandra Charikova

1 min read

Different types of penetration testing

Pentesting

Different types of penetration testing

Penetration testing, commonly known as pentesting, involves simulating a real attack on a server to assess its vulnerabilities against potential real-world attacks. While the primary goal is to emulate concrete threats, pentesting can extend beyond, offering insights into the potential consequences if confidential data were to fall into malicious hackers' hands. Curious about the various categories of pentesting? Dive into this article! (And as a bonus, find guides on how to conduct pentesting

Alexandre Tang

Alexandre Tang

11 min read

SAST vs DAST: how to make the choice and combine them effectively

Application Security

SAST vs DAST: how to make the choice and combine them effectively

Should you choose between SAST and DAST? Perhaps the real question is, why not use both in your application security strategy? Let's be honest—vulnerabilities are often discovered when it's too late. No matter how well developers follow secure coding guidelines, it's impossible to keep an eye on every detail. Business teams frequently put additional pressure to deliver within tight deadlines. As pressure mounts, stakes rise, and, oops, a small mistake leads to a SQL injection in production. Th

Elliot Négrel-Jerzy

Elliot Négrel-Jerzy

8 min read

Vulnerability Management Lifecycle: 5 Steps and Best Practices

Application Security

Vulnerability Management Lifecycle: 5 Steps and Best Practices

Maintaining robust security of your organization is not just crucial in 2023 – it's a survival strategy. The recent data breach at 23andMe in October 2023 is a case in point. This incident, where a credential-stuffing attack led to unauthorized access to customer accounts, underscores a harsh reality. Even biotech companies, handling sensitive genetic data, aren't immune to cyber threats. It shows us how vulnerabilities, if left unchecked, can compromise not just data but also customer trust. Th

Alexandra Charikova

Alexandra Charikova

15 min read

Introducing Agentless API Discovery & Inventory

Announcement

Introducing Agentless API Discovery & Inventory

Today, we’re finally unveiling new capabilities of Escape - agentless discovery and inventory of APIs within their specific business context.

Tristan Kalos

Tristan Kalos

2 min read

Introducing your new API security testing assistant: Meet our GPT Bot!

API Security

Introducing your new API security testing assistant: Meet our GPT Bot!

Hey there 👋 We've got some exciting news to share with you today! We're thrilled to introduce you to our brand-new API security testing assistant: the GPT Bot "API Guardian". Are you tired of spending endless hours proactively looking for the best practices to test and secure APIs? Well, your search is over! Our GPT Bot is here to simplify and streamline the entire process for you. What is the GPT Bot, and how can it help you? Since last week, OpenAI has been letting anyone create their o

Alexandra Charikova

Alexandra Charikova

6 min read

Webinar: Building Your Product Security Roadmap

Events

Webinar: Building Your Product Security Roadmap

Whether you're in the first few weeks of your ProdSec journey or building your Product security program for 2024, you might feel lost trying to wrap your head around all the attack surface your org faces and identifying some of the biggest security gaps. Don't worry, we're here to help! 💡Missed the live webinar? No problem! Sign up, and you'll receive a recording of the session. Join our webinar with Product Security expert, James Berthoty, and get insights you need to start building a robust

Alexandra Charikova

Alexandra Charikova

1 min read

Case Study: How Lightspeed ensures full security compliance with Escape

Case Study

Case Study: How Lightspeed ensures full security compliance with Escape

Lightspeed, a technology partner to more than 160,000 global retail and hospitality businesses, has recently transitioned to a centralized payments model and adopted GraphQL APIs as a cornerstone of its operations. GraphQL allowed Lightspeed to improve both efficiency and flexibility in data retrieval, resulting in better overall system performance. However, this adoption of GraphQL required the implementation of new robust security measures. Use cases 1. Continuous API discovery 2. Simplif

Alexandra Charikova

Alexandra Charikova

3 min read

How to establish an application security policy

Application Security

How to establish an application security policy

As organizations increasingly rely on web and mobile applications to conduct business, robust application security has become paramount. Cyberattacks are on the rise, and without adequate protection, businesses risk losing sensitive data, revenue, and reputational damage. Having an application security policy in place is the first line of defense against such threats. To give you an example: just a month ago, MGM Resorts’ Las Vegas area operations to took $100M hit from social engineering cyber

Escape - Offensive Security

Escape - Offensive Security

14 min read

DevOps vs DevSecOps: exploring the key differences and how to make the shift

DevSecOps

DevOps vs DevSecOps: exploring the key differences and how to make the shift

Companies are constantly searching for ways to deliver high-quality products quickly and efficiently. The evolution of DevOps revolutionized the industry by merging development and operations teams, breaking down silos, and fostering collaboration and communication. However, as startups and businesses strive for agility and speed, security often falls by the wayside. This is where DevSecOps steps in - the integration of security practices into the DevOps framework. In this article, we will exp

Quentin Lieumont

Quentin Lieumont

9 min read

Escape API Security Checklist

API Security

Escape API Security Checklist

Are you looking to make your API security program stronger? Do you sometimes find it challenging to spot and address security vulnerabilities effectively? You're not alone! Many security professionals like you face challenges in improving API security because technology and cyber threats keep changing. This makes ensuring strong API security a complex but vital task. This checklist can help. You can use these guidelines to improve your API security posture. Feel free to adapt these guidelines t

Tristan Kalos

Tristan Kalos

1 min read

Escape vs 42Crunch: A Complete Comparison 2025

Competitor Comparison

Escape vs 42Crunch: A Complete Comparison 2025

Today, attackers prioritize exploiting an application's business logic flaws and API vulnerabilities, which may result in the unauthorized extraction of sensitive data. Understanding an application's business logic is challenging, and requires a security platform that comprehends an application's functionalities to address complex API attacks. So I think there's going to be a long time before that happens, and I suspect that we're going to have a lot more like us, as security folks, we'll proba

Escape - Offensive Security

Escape - Offensive Security

7 min read

What is API discovery, and how does it work?

API Discovery

What is API discovery, and how does it work?

Ever wondered how applications effortlessly communicate and collaborate, seamlessly sharing data and functionalities? Enter API discovery – the game-changer in modern development. What if finding and connecting with APIs was as intuitive as flipping a switch? As the newly appointed security engineer, you quickly realize the sprawling web of APIs that power the company's services and pose unseen vulnerabilities. Every undocumented API feels like a ticking time bomb, a potential gateway for malic

Sophie Boulaaouli

Sophie Boulaaouli

6 min read

Application security audit: an in-depth guide

AppSec

Application security audit: an in-depth guide

Introduction What are application security audits? In information technologies departments, application security audits are systematic evaluations conducted to assess the security posture of an organization's applications. Application security audits involve finding possible threats and determining the organization's attack surface. The different vectors that attackers can leverage to harm a corporation determine this scope. Role of application security audits in risk management B

Maxence Lecanu

Maxence Lecanu

7 min read

Escape is now SOC 2 Type II compliant

Announcement

Escape is now SOC 2 Type II compliant

We worked hard to complete the process and get the SOC 2 Type II compliance and finally it's done!

Alexandra Charikova

Alexandra Charikova

2 min read

Introducing business logic security testing for REST APIs

API Security

Introducing business logic security testing for REST APIs

After one year and a half of approaching API security through the lenses of GraphQL, we are proud to introduce full support for REST API Security Testing in Escape, in addition to GraphQL 🚀 You like us on GraphQL. You will love us on REST. It's been a ride since Escape's public release of our GraphQL security platform last September. To enrich this core capability, we have been shipping many new features since our public release: API Inventory, Posture Management, CI/CD Integrations, SSO, a

Antoine CarossioTristan Kalos

Antoine Carossio, Tristan Kalos

3 min read

How to automate and secure deployment within GitLab CI with Syft and Grype

DevSecOps

How to automate and secure deployment within GitLab CI with Syft and Grype

Ensuring the security of your code is paramount in today's fast-paced development landscape. Thankfully, the automation capabilities of CI/CD pipelines can make this process seamless. In this article, we'll guide you through setting up a GitLab CI pipeline that automates code security checks, allowing you to focus on your code with the assurance that you'll only be alerted when your attention is required. 💡tldr; Learn how to set up a secure and automated Continuous Integration/Continuous Deplo

Quentin Lieumont

Quentin Lieumont

7 min read