40 posts
AI pentesting
Disclosure-to-exploit time is now hours, not weeks. Escape Continuous AI Pentesting tests only what each release changes, on every merge, deploy, or schedule. Attack paths are tailored from past reports and with OSCP certifications you can always stay audit-ready.
Product updates
How Cascade 2 Iguazu's scheduler and shared coverage map work together, how we benchmark the engine, and what two rounds of internal benchmarks reveal.
Product updates
Offensive security teams are covering more dev teams every quarter without their own headcount growing to match. Their roles continue to be forced into project management and firefighting instead of finding the vulnerabilities that get them speaking spots at conferences. Our latest batch of features removes manual steps that eat away a security engineer's week. Waiting on a full re-run to confirm a fix, manually entering credentials into scan configs, zipping source code over Slack, or chasing
Product updates
Run Escape's AI Pentesting with your source code.
Product updates
wp2shell is an unauthenticated RCE chain in WordPress core. It combines two separate vulnerabilities: CVE-2026-63030 and CVE-2026-60137. Escape detects it across DAST and AI Pentesting, confirms exploitability, and shows affected assets within its Attack Surface Management.
Product updates
There's a translation step between a security finding and a fix, and it's usually done by hand. Someone opens the issue, reads the description, checks the CVSS score, follows the link to the affected asset, works out which endpoint is actually involved, then writes all of it back out as a prompt for whatever agent they code with. The information was already there. It just wasn't in the shape the agent needed. Escape now does that step for you. From any issue in the platform, you can send the
Application Security
What each agent actually does (BOLA, Regression testing agent, Business logic testing agent, and others..), how they coordinate, and what you can expect from Escape's AI pentesting product in the upcoming weeks.
Product updates
How to Visualize Web & API Coverage and Validate Attack Path in Escape DAST
Product updates
Assign the assets to the right project, add the right people, and let them start reviewing findings and patching what needs to be patched.
Product updates
Discover the latest features we’ve shipped, from multi-tenant testing to enhanced scan failure visibility!
Product updates
Discover a step-by-step workflow you can plug directly into your development process
Product updates
Until now, custom rules in Escape were limited to single-request vulnerabilities. You could only define and test one request at a time. This meant that more complex vulnerabilities, such as those requiring multiple chained steps (e.g., creating a user, then editing that user to escalate privileges), couldn’t be implemented. That changes today. 💡TL;DR: Escape now supports multi-step custom rules. You can chain requests, extract and transform data (tokens, IDs, etc.), and reinject it into subs
Product updates
Most of today’s SaaS structures are multi-tenant environments. Making sure that each tenant’s data and resources are securely isolated from others is critical. Weaknesses or misconfigurations in tenant isolation can lead to unauthorized access or data leaks between tenants, compromising the security of the entire system. If you’re serious about maintaining strict isolation and protecting your tenants' data (so you can relax when the Thanksgiving madness hits), this product release is right up y
Product updates
Security teams know that finding a vulnerability is only half the battle. The harder part is validating that it can be exploited and applying the right fix with confidence. Too often, remediation guidance is static, generic, or incomplete, leaving engineers guessing. This also strains the relationships between security and developers. As a result, vulnerable applications stay longer exposed to attackers. That’s why we’re introducing AI-powered proof of exploit and remediation guidelines. It sho
Product updates
August is usually synonymous with vacations, beach days, and relaxation. But here at Escape, we’re not taking a break from empowering security teams (just kidding, we still took a break, but we shipped more efficiently!). While many are winding down, we’re cranking up the pace with some exciting product updates that will make it easier for you to reduce your organization's risk and streamline your workflows. This month, we’re giving you the ability to modify configurations at the global level,
Product updates
This June, we’re making it easier to test real-world applications with complex authentication flows without sacrificing automation. Security teams need to test applications exactly as they exist in production, including MFA and CAPTCHA-protected flows. Historically, these protections aren’t "scanner-friendly" and often introduce friction into DAST workflows. With our new TOTP MFA and AI-powered text CAPTCHA solving, Escape now enables fully automated testing on applications protected by these
Product updates
Meet Escape Copilot. Powered by the MCP over the Escape Public API, it helps you boost productivity and get more done with less context switching inside Escape.
Product updates
Ticketing systems are an essential part of modern DevSecOps. They orchestrate cross-functional collaboration, ensure accountability, and drive issues to resolution. But in application security, the value of ticketing hinges on one critical factor: context. Too often, security tools generate vague alerts or findings without right context associated with them that create noise rather than clarity. Developers are confused with information being fed to them via tickets, which makes the wh
Product updates
Escape has created the first ever push-to-post automation to revolutionize vulnerability management by giving you the recognition you deserve.
Product updates
We all know how frustrating the authentication process can be when running DAST scans. It's one of the most common pain points our customers face, and it often becomes a roadblock that slows down testing cycles. Whether it's dealing with complex custom authentication processes or navigating the restrictions imposed by modern web apps, authentication remains one of the trickiest challenges when it comes to using a DAST tool. Imagine this: your current provider only captures the credentials, then
Product updates
In addition to our bi-directional Integration with Wiz, we have more product updates for you this month!
Product updates
The start of a new year brings exciting updates to our DAST scanner! Our goal is simple: to improve testing accuracy by leveraging real, concrete examples of API requests when they might be required. While we don’t need to have direct access to live traffic to start in-depth testing, we’ve made it easier than ever to import and use traffic examples - giving you better results and more actionable insights (without performance overhead). Here’s a closer look at what’s new: Discover our ne
Product updates
Identify undocumented and potentially vulnerable APIs in your Kubernetes clusters with ease.
