Search

Escape - Application Security & Offensive Security Blog

Explore practical offensive and application security insights covering web application testing, emerging AI cybersecurity research, API and GraphQL security, and advanced testing techniques.

Filters

Two Major Updates from The Elephant in AppSec Conference: Agenda Is Live & Partnership with InfoSecMap

Application Security

Two Major Updates from The Elephant in AppSec Conference: Agenda Is Live & Partnership with InfoSecMap

Two exciting updates in the Elephant in AppSec corner! 1. The Elephant in AppSec Conference 2026 Agenda Is Now Live The agenda for the 2026 edition of The Elephant in AppSec Conference is officially published. This year’s program brings together a lineup of speakers who aren’t afraid to challenge assumptions and share strong, sometimes controversial perspectives on the state of application security. From DevSecOps and security culture shifts to the rising influence of Agentic AI across all a

Alexandra Charikova

Alexandra Charikova

3 min read

Escape's DAST proprietary Business Logic Security Testing algorithm: what makes it innovative

API Security

Escape's DAST proprietary Business Logic Security Testing algorithm: what makes it innovative

Testing APIs for Business Logic vulnerabilities is hard. Actually, this is a mission that old-school DAST solutions like ZAP (formerly OWASP ZAP) cannot handle. I'm Antoine Carossio, passionate about Computer Science for more than 15 years now and cofounder & CTO of Escape. With my team, we've spent 3 years building a proprietary algorithm capable of finding Business Logic vulnerabilities in all API types, especially in the most recent ones like REST & GraphQL. However, simply stating its exis

Antoine Carossio

Antoine Carossio

10 min read

Escape Monthly Product Updates — December

Product updates

Escape Monthly Product Updates — December

Discover the latest features we’ve shipped, from multi-tenant testing to enhanced scan failure visibility!

Alexandra Charikova

Alexandra Charikova

7 min read

Agentic Pentesting: The Complete Guide to Get Started in 2026

Pentesting

Agentic Pentesting: The Complete Guide to Get Started in 2026

Explore this complete guide to agentic pentesting and learn how agentic pentesting architecture works, the key benefits it delivers, and the tools you can integrate into your security workflow.

Alexandra Charikova

Alexandra Charikova

16 min read

best AI pentesting tools

Pentesting

Best 8 AI Pentesting Tools in 2026

Explore the best AI pentesting tools in 2026. Learn how modern pentesting solutions detect business logic flaws and scale continuous security testing, so security teams can replace manual pentests with faster, more accurate coverage. Updated: August 2026

Alexandra CharikovaAntoine Carossio

Alexandra Charikova, Antoine Carossio

26 min read

Reproduce complex exploits in Escape: Multi-Step Custom Rules Are Here

Product updates

Reproduce complex exploits in Escape: Multi-Step Custom Rules Are Here

Until now, custom rules in Escape were limited to single-request vulnerabilities. You could only define and test one request at a time. This meant that more complex vulnerabilities, such as those requiring multiple chained steps (e.g., creating a user, then editing that user to escalate privileges), couldn’t be implemented. That changes today. 💡TL;DR: Escape now supports multi-step custom rules. You can chain requests, extract and transform data (tokens, IDs, etc.), and reinject it into subs

Alexandra Charikova

Alexandra Charikova

5 min read

[Webinar] Automating Offensive Security with AI: A Guide to Scaling Pentesting with Escape

[Webinar] Automating Offensive Security with AI: A Guide to Scaling Pentesting with Escape

Automated pentesting is now one of the most hyped topics in cybersecurity, with AI systems promising to replace human hackers. But how much is real, and how much is marketing hype? This webinar provides a practical guide to automating offensive security, built from the perspective of offensive and application security leaders we worked with who’ve spent years pushing the boundaries of what can (and can’t) be automated. We've often heard: "I have only 15 minutes to manually test each new featur

Alexandra Charikova

Alexandra Charikova

1 min read

From Complex Authentication to Confident Coverage: How Applied Systems Transformed Their AppSec with Escape

Case Study

From Complex Authentication to Confident Coverage: How Applied Systems Transformed Their AppSec with Escape

In a recent webinar on "From Business Logic Vulnerabilities to Actionable Insights: AI-powered Pentesting + ASM in Action," Andrew Orr Erwing, Manager of Security Engineering (AppSec) at Applied Systems, shared his team's journey in modernizing their application security approach. For organizations that have grown rapidly through acquisitions, application security can become a labyrinth of complexity. Applied Systems found themselves facing this exact challenge—a sprawling tech infrastructure w

Alexandra Charikova

Alexandra Charikova

4 min read

Methodology: How we discovered over 2k high-impact vulnerabilities in apps built with vibe coding platforms

Research

Methodology: How we discovered over 2k high-impact vulnerabilities in apps built with vibe coding platforms

Hey there, With Halloween around the corner, what’s scarier for organizations than vulnerabilities in their web applications? And it's even scarier when the development of these applications is in the hands of users not familiar with security practices. This year, the Escape research team has focused on a growing area of concern: vibe-coded applications. Purpose-built platforms like Lovable.dev, Base44.com, and Create.xyz have democratized application development, enabling non-developers to d

Nohé Hinniger-ForayGwendal MognierAlexandra Charikova

Nohé Hinniger-Foray, Gwendal Mognier, Alexandra Charikova

10 min read

Introducing Multi-User Testing with Natural Language Queries in Escape DAST

Product updates

Introducing Multi-User Testing with Natural Language Queries in Escape DAST

Most of today’s SaaS structures are multi-tenant environments. Making sure that each tenant’s data and resources are securely isolated from others is critical. Weaknesses or misconfigurations in tenant isolation can lead to unauthorized access or data leaks between tenants, compromising the security of the entire system. If you’re serious about maintaining strict isolation and protecting your tenants' data (so you can relax when the Thanksgiving madness hits), this product release is right up y

Antoine Carossio

Antoine Carossio

8 min read

Detectify alternatives in 2026: Escape vs Detectify and 4 more tools

Competitor Comparison

Detectify alternatives in 2026: Escape vs Detectify and 4 more tools

Looking for a Detectify alternative? Compare Escape vs Detectify on API and app security, pricing, G2 ratings, and key features. See why security teams choose this application security scanner for business logic testing and internal app scanning.

Alexandra Charikova

Alexandra Charikova

19 min read

Gin & Juice Shop Benchmark: How DAST Tools Really Stack Up

Application Security

Gin & Juice Shop Benchmark: How DAST Tools Really Stack Up

This month, we set out to compare our DAST against some of the established names in Dynamic Application Security Testing. We’ve already benchmarked our scanner on vulnerable apps like VAMPI and DVGA, and now we’re putting it up against Qualys, ZAP, and Intruder (available in free trial) on Gin & Juice Shop. Why are we doing this? Our scanner uses in-house built web crawling and business logic testing algorithms, designed from scratch to handle modern applications. Naturally, we get asked “How d

Gwendal MognierAntoine Carossio

Gwendal Mognier, Antoine Carossio

11 min read

Why context is king in Attack Surface Management (ASM): Key insights from my conversations with security leaders

Attack Surface Management

Why context is king in Attack Surface Management (ASM): Key insights from my conversations with security leaders

When I launched this research, my goal was to understand the current perception of security practitioners regarding Attack Surface Management (ASM) solutions. Unlike in my previous article, "What is wrong with the current state of DAST?" I didn't start with an overall negative perception from the security practitioners. I was just generally curious and asked quite open-ended questions to see if anyone even had strong opinions on ASM (some didn’t!). One key takeaway from the DAST research was th

Alexandra Charikova

Alexandra Charikova

8 min read

Introducing AI-Powered Exploit Validation and Remediation Guidelines

Product updates

Introducing AI-Powered Exploit Validation and Remediation Guidelines

Security teams know that finding a vulnerability is only half the battle. The harder part is validating that it can be exploited and applying the right fix with confidence. Too often, remediation guidance is static, generic, or incomplete, leaving engineers guessing. This also strains the relationships between security and developers. As a result, vulnerable applications stay longer exposed to attackers. That’s why we’re introducing AI-powered proof of exploit and remediation guidelines. It sho

Alexandra Charikova

Alexandra Charikova

4 min read

[Webinar] From Business Logic Vulnerabilities to Actionable Insights: AI-powered Pentesting + ASM in Action

Application Security

[Webinar] From Business Logic Vulnerabilities to Actionable Insights: AI-powered Pentesting + ASM in Action

For years, security teams have relied on human penetration testers to uncover critical vulnerabilities hidden in complex business logic. These flaws are subtle, context-dependent, and unique to every system’s workflow. Even modern scanners struggle to capture them, focusing only on a limited range of vulnerabilities displayed in their UI. At Escape, we’ve spent years developing an AI system that goes beyond surface-level issues. It understands application behavior, uncovers vulnerabilities that

Alexandra Charikova

Alexandra Charikova

2 min read

August Product Updates: Enhancements to the Escape Public API and CLI, and the Introduction of Global Configuration Management

Product updates

August Product Updates: Enhancements to the Escape Public API and CLI, and the Introduction of Global Configuration Management

August is usually synonymous with vacations, beach days, and relaxation. But here at Escape, we’re not taking a break from empowering security teams (just kidding, we still took a break, but we shipped more efficiently!). While many are winding down, we’re cranking up the pace with some exciting product updates that will make it easier for you to reduce your organization's risk and streamline your workflows. This month, we’re giving you the ability to modify configurations at the global level,

Alexandra Charikova

Alexandra Charikova

7 min read

Top Automated Penetration Testing Tools (2026)

Pentesting

Top Automated Penetration Testing Tools (2026)

Explore the best automated penetration testing tools of 2026. Learn how modern pentesting solutions detect business logic flaws and scale continuous security testing, so security teams can replace manual pentests with faster, more accurate coverage.

Antoine CarossioAlexandra Charikova

Antoine Carossio, Alexandra Charikova

29 min read

Top Vulnerability Scanning tools 2026

Application Security

Top Vulnerability Scanning tools 2026

In 2026, vulnerability scanning tools are essential for modern security teams, but running a scan is rarely the hard part anymore. The real challenge is automating it at scale: across thousands of assets, spanning APIs, web applications, and cloud services, in environments that can change by the hour. Security engineers are voicing this exact frustration. You can find it in multiple Reddit threads, like the one below, where a user asked how others automate vulnerability management in

Harikiran NannapaneniAntoine Carossio

Harikiran Nannapaneni, Antoine Carossio

23 min read

How to Automate Your Penetration Testing?

Application Security

How to Automate Your Penetration Testing?

AI is revolutionizing penetration testing, transforming traditionally manual exploits, once spanning several days, into automated systems that can now handle reconnaissance, scanning, and fuzzing in a matter of hours. Automate your pentesting For teams that deploy every day Book a demo → Learn more "AI is already transforming pentesting. If you look at automated reconnaissance and scanning, finding those low-hanging fruits, or threat intelligence correlation, it does it

Alexandra Charikova

Alexandra Charikova

11 min read