API Discovery
How Escape’s agentless API discovery technology works
Discover what makes Escape's agentless API discovery technology truly innovative.
Application Security
121 posts
API Security
Reinventing API security: Why traditional DAST tools miss API vulnerabilities
We have been doing API Security wrong. Discover how the limitations of DAST API security tools might impact your security and why Escape's technology is the best way to protect your APIs.
API Security
Reinventing API security: Why Escape is better than traditional traffic-based tools
We have been doing API Security wrong. Discover how the limitations of traffic-based API security tools might impact your security and why Escape's agentless technology is the best way to protect your APIs.
API Security
The State of GraphQL Security 2024
Insights from 13,000 GraphQL API issues: Read our deep dive into the current state of GraphQL security.
API Security
Limitations of current automatic specification generation tools
Have you ever wondered how automatic specification generation can streamline API security scanning? By significantly reducing the manual effort involved in creating and maintaining API specifications, automated tools offer clear benefits in terms of scan accuracy and setup time. Yet, many existing tools on the market have notable limitations. Understanding these constraints is essential to fully appreciate how Escape's approach to automated spec generation stands out. Code-first tools C
Webinar recap
Webinar recap: How to build relationships with developers?
Join our guest expert, Dustin Lehr, to learn how to earn developers' respect, introduce gamification, and get issues fixed in a security context.
Application Security
How to secure non-human identities? with Andrew Wilder and Amir Shaked
This blog is based on our conversation with Andrew Wilder, Retained Chief Security Officer at Community Veterinary Partners and Amir Shaked, VP of R&D at Oasis Security. It covers the unique challenges of securing non-human identities.
Application Security
The Elephant in AppSec Conference is here!
Get ready for some opinionated talks.
Application Security
Software Supply Chain Risks ⎪Cassie Crossley (VP Supply Chain Security, Schneider Electric)
This blog is based on our conversation with Cassie Crossley, Vice President of Supply Chain Security at Schneider Electric. It covers the unique challenges of software supply chain security.
Webinar
Webinar: How to build relationships with developers
Are you a security leader struggling to connect meaningfully with your developers? Join our guest expert, Dustin Lehr, to learn how to earn developers' respect, introduce gamification, and get issues fixed.
Podcast
Security challenges in the financial sector⎪Max Imbiel (CISO, Bitpanda)
This blog is based on the podcast episode with Max Imbiel, CISO at Bitpanda. It covers the unique challenges of building secure financial applications.
API Security
DAST is dead, why Business Logic Security Testing takes center stage
“DAST is dead” - that’s the phrase that appears every year on social media and in cybersecurity newsletters. But what if in 2024, it finally came true? DAST, Dynamic Application Security Testing (even though we see a new terminology “Dynamic API Security Testing” popping up here and there within the last weeks), has been a cornerstone of application security testing in the last decade but it’s time to make way for the next generation of application security testing - Business Logic Security Tes
API Inventory
API Inventory: New features and improvements
With our updates to API discovery and inventory, you gain even more capabilities to easily achieve complete governance.
Custom Security Tests
Are custom security tests a product security superpower? ⎜Keshav Malik (LinkedIn)
Welcome to the Elephant in AppSec, the podcast to explore, challenge, and boldly face the AppSec Elephants in the room. In this article, we'll cover the main takeaways from our conversation with Keshav Malik, a senior Product Security Engineer at LinkedIn. Our goal is to help you understand how to better write your custom security tests. Dive right in! Keshav's background Keshav is a Senior Product Security Engineer at LinkedIn. With experience in information security and a passion for autom
Application Security
How to secure cloud-native applications
This article is based on the Elephant in AppSec podcast episode with Mihir Shah, a Senior Staff Application Security Engineer at ForgeRock, and the author of the Cloud Native Software Security Handbook.
API Discovery
The challenges and opportunities of API governance in 2024
Learn more about the concept of API sprawl, its implications, and the challenges and importance of API governance.
API Security
Workshop "How to write custom security tests" - Main Takeaways
Organizations are constantly seeking ways to improve their defenses against business logic vulnerabilities. These vulnerabilities, often difficult to detect, can lead to significant security breaches if left unchecked. To address this challenge, we've introduced a new feature within our platform that empowers teams to create custom business logic tests for APIs, enabling the identification and remediation of security flaws at scale. To explain how to get started with custom security tests, we h
API Security
Why security engineers need a new approach to identify business logic flaws
In the last decade, security scanners have evolved to identify common vulnerabilities like SQL injections. But that’s just not enough anymore. In 2024, data leaks in applications come from exploiting business logic flaws. In the next few years, applications will grow in size and number too fast, so the true advantage will come from being able to find business logic vulnerabilities at scale. The growing diversity of security tools changed the way we secured our applications in recent years. Th
Podcast
The art and science of product security: A deep dive with Jacob Salassi
Welcome to the Elephant in AppSec, the podcast to explore, challenge, and boldly face the AppSec Elephants in the room. Today we’re excited to have an amazing guest, Jacob Salassi, join us. You can find the main takeaways from our conversation with Jacob just down below! Jacob's background Jacob is the Director of Product Security and Regulatory Expansion at Snowflake, where he has played a pivotal role in guiding the company through its pre- and post-IPO phases. With over 15 years of exper
Application Security
Building security training for developers in 2024: Is it really worth it and how to proceed?
If you're a security engineer, the chances that you've struggled with your development team to implement secure coding practices are high. If you don't have the right culture in your organization, it might be even harder. Developers consider you as an adversary, rather than an ally that's here to help them. It feels like an uphill battle day in, day out. We had great training at Segment, where we had two parts where every single new engineer had to go through it. We had to think like an attacke
API Security
How to secure your API secret keys from being exposed?
Learn about the dangers of API secret key exposure and discover our selection of prevention strategies.
Podcast
Developers and security training: can they co-exist?⎜Laura Bell Main
Welcome to the Elephant in AppSec, the podcast to explore, challenge, and boldly face the AppSec Elephants in the room. Today, we’re excited to have an amazing guest, Laura Bell Main, join us. With over 20 years in software development and application security, Laura is the co-founder and CEO of SafeStack, an online education platform that offers secure development training for fast-moving companies. Laura is also a well-known keynote speaker and has spoken at high-profile events like BlackHa
API Security
API security for PCI compliance: A deep dive into the PCI DSS 4.0 impact
There are more than 50 new requirements in PCI DSS v4.0 – do you know which ones apply to you and what you need to do to meet them? The March deadline is approaching, and we want to ensure you're fully prepared for the changes ahead. The deadline for compliance in the first phase (with 13 broad new requirements) of PCI DSS 4.0 is March 31, 2024. The implementation deadline for a second phase, comprising requirements of a mostly more technical nature, follows a year later. For the complete lis
API Security
How to secure gRPC APIs
Looking for ways to secure gRPC APIs? Don't worry, we've got you covered! In this article, we will be exploring the topic of gRPC security and its importance in ensuring the security of API endpoints. We will also discuss the role of dynamic application security testing (DAST) tools in securing gRPC APIs and identifying and fixing vulnerabilities before they reach production. What is gRPC? gRPC is a high-performance, open-source RPC (Remote Procedure Call) framework developed by Google.