121 posts
Pentesting
Explore the best Agentic pentesting tools of 2026. Learn how modern pentesting solutions detect business logic flaws and scale continuous security testing, so security teams can replace manual pentests with faster, more accurate coverage.
Application Security
Two exciting updates in the Elephant in AppSec corner! 1. The Elephant in AppSec Conference 2026 Agenda Is Now Live The agenda for the 2026 edition of The Elephant in AppSec Conference is officially published. This year’s program brings together a lineup of speakers who aren’t afraid to challenge assumptions and share strong, sometimes controversial perspectives on the state of application security. From DevSecOps and security culture shifts to the rising influence of Agentic AI across all a
DAST
We ran three scanners against a vulnerable REST API and a vulnerable GraphQL app, comparing findings, request volume, setup time, and scan duration.
Pentesting
Explore this complete guide to agentic pentesting and learn how agentic pentesting architecture works, the key benefits it delivers, and the tools you can integrate into your security workflow.
Pentesting
Explore the best AI pentesting tools in 2026. Learn how modern pentesting solutions detect business logic flaws and scale continuous security testing, so security teams can replace manual pentests with faster, more accurate coverage. Updated: August 2026
Product updates
Discover a step-by-step workflow you can plug directly into your development process
Case Study
In a recent webinar on "From Business Logic Vulnerabilities to Actionable Insights: AI-powered Pentesting + ASM in Action," Andrew Orr Erwing, Manager of Security Engineering (AppSec) at Applied Systems, shared his team's journey in modernizing their application security approach. For organizations that have grown rapidly through acquisitions, application security can become a labyrinth of complexity. Applied Systems found themselves facing this exact challenge—a sprawling tech infrastructure w
Research
Hey there, With Halloween around the corner, what’s scarier for organizations than vulnerabilities in their web applications? And it's even scarier when the development of these applications is in the hands of users not familiar with security practices. This year, the Escape research team has focused on a growing area of concern: vibe-coded applications. Purpose-built platforms like Lovable.dev, Base44.com, and Create.xyz have democratized application development, enabling non-developers to d
Product updates
Most of today’s SaaS structures are multi-tenant environments. Making sure that each tenant’s data and resources are securely isolated from others is critical. Weaknesses or misconfigurations in tenant isolation can lead to unauthorized access or data leaks between tenants, compromising the security of the entire system. If you’re serious about maintaining strict isolation and protecting your tenants' data (so you can relax when the Thanksgiving madness hits), this product release is right up y
Competitor Comparison
Looking for a Detectify alternative? Compare Escape vs Detectify on API and app security, pricing, G2 ratings, and key features. See why security teams choose this application security scanner for business logic testing and internal app scanning.
Application Security
This month, we set out to compare our DAST against some of the established names in Dynamic Application Security Testing. We’ve already benchmarked our scanner on vulnerable apps like VAMPI and DVGA, and now we’re putting it up against Qualys, ZAP, and Intruder (available in free trial) on Gin & Juice Shop. Why are we doing this? Our scanner uses in-house built web crawling and business logic testing algorithms, designed from scratch to handle modern applications. Naturally, we get asked “How d
Attack Surface Management
When I launched this research, my goal was to understand the current perception of security practitioners regarding Attack Surface Management (ASM) solutions. Unlike in my previous article, "What is wrong with the current state of DAST?" I didn't start with an overall negative perception from the security practitioners. I was just generally curious and asked quite open-ended questions to see if anyone even had strong opinions on ASM (some didn’t!). One key takeaway from the DAST research was th
![[Webinar] From Business Logic Vulnerabilities to Actionable Insights: AI-powered Pentesting + ASM in Action](/blog/content/images/size/w600/format/webp/2025/09/business-logic-attack-surface-management-webinar.png)
Application Security
For years, security teams have relied on human penetration testers to uncover critical vulnerabilities hidden in complex business logic. These flaws are subtle, context-dependent, and unique to every system’s workflow. Even modern scanners struggle to capture them, focusing only on a limited range of vulnerabilities displayed in their UI. At Escape, we’ve spent years developing an AI system that goes beyond surface-level issues. It understands application behavior, uncovers vulnerabilities that
Podcast
Discover insights from The Elephant in AppSec episode with Marisa Fagan.
Application Security
In 2026, vulnerability scanning tools are essential for modern security teams, but running a scan is rarely the hard part anymore. The real challenge is automating it at scale: across thousands of assets, spanning APIs, web applications, and cloud services, in environments that can change by the hour. Security engineers are voicing this exact frustration. You can find it in multiple Reddit threads, like the one below, where a user asked how others automate vulnerability management in
Application Security
AI is revolutionizing penetration testing, transforming traditionally manual exploits, once spanning several days, into automated systems that can now handle reconnaissance, scanning, and fuzzing in a matter of hours. Automate your pentesting For teams that deploy every day Book a demo → Learn more "AI is already transforming pentesting. If you look at automated reconnaissance and scanning, finding those low-hanging fruits, or threat intelligence correlation, it does it
Podcast
Discover insights from The Elephant in AppSec episode with Jyoti Raval
Podcast
Discover insights from The Elephant in AppSec episode with Kevan Bard.
Podcast
Discover insights from The Elephant in AppSec episode with Sean Finley.
Application Security
“You ask the developer why they wrote the code the way that they did, and they don’t have an answer anymore. They’re like, ‘Well, AI wrote it.” - Seth Kirschner, DoubleVerify AI is now deeply embedded in software development workflows, and the implications for application security teams are profound. Gone are the days when engineers wrote every line of code themselves, fully understanding the rationale and risks behind each implementation. Today, developers are working side-by-side with tools l
Application Security
In this article, we'll show how we created our web application crawling algorithm to ensure complete testing coverage for modern applications.
![[Webinar] Securing AI-driven applications with DAST](/blog/content/images/size/w600/format/webp/2025/06/secure-ai-driven-apps-dast.png)
Application Security
Join us for a live webinar with application security experts and Escape clients - Seth Kirschner (DoubleVerify), Nathan Byrd (Applied Systems), Nick Semyonov (PandaDoc), as they break down how their teams are rethinking testing strategies to keep up with AI-influenced codebases.
Product updates
Meet Escape Copilot. Powered by the MCP over the Escape Public API, it helps you boost productivity and get more done with less context switching inside Escape.
Product updates
Ticketing systems are an essential part of modern DevSecOps. They orchestrate cross-functional collaboration, ensure accountability, and drive issues to resolution. But in application security, the value of ticketing hinges on one critical factor: context. Too often, security tools generate vague alerts or findings without right context associated with them that create noise rather than clarity. Developers are confused with information being fed to them via tickets, which makes the wh
