initial

evaluation_security_escape.md

@@ -0,0 +1,322 @@
+# Security AI Tool Evaluation: Escape AI Pentesting
+
+## Tool Overview
+**Name:** Escape (formerly Escape.tech)
+**Type:** AI-Powered API Security & Pentesting Platform
+**Website:** https://escape.tech
+**Primary Function:** Automated API security testing, vulnerability scanning, penetration testing for APIs (REST, GraphQL, gRPC)
+
+---
+
+## Privacy Policy & Enterprise Compatibility
+
+### Commercial/Enterprise Use Permission
+**Status:** REQUIRES MANUAL VERIFICATION
+**Sources to Check:**
+- Privacy Policy: https://escape.tech/privacy (or https://escape.tech/legal/privacy)
+- Terms of Service: https://escape.tech/terms (or https://escape.tech/legal/terms)
+- Legal Documentation: https://escape.tech/legal
+
+**Key Questions:**
+- Does the privacy policy explicitly permit commercial use?
+- Are there any restrictions on enterprise deployment?
+- What is the licensing model for commercial use?
+- Any restrictions on testing production APIs?
+- Any geographic restrictions?
+
+### Data Training & Model Use
+**Status:** REQUIRES MANUAL VERIFICATION
+**Sources to Check:**
+- Privacy Policy: https://escape.tech/privacy
+- AI/ML disclosure in documentation
+- Security documentation: https://docs.escape.tech/
+
+**Key Questions:**
+- Is customer API data used to train or improve AI models?
+- How does the AI-powered pentesting work?
+- Can customers opt out of data collection for model training?
+- What API data is collected during testing (endpoints, payloads, responses)?
+- Are test results used to improve detection algorithms?
+- Is any data anonymized and aggregated for ML training?
+- How are API schemas and specifications handled?
+
+### Data Retention Policies
+**Status:** REQUIRES MANUAL VERIFICATION
+**Sources to Check:**
+- Privacy Policy: https://escape.tech/privacy
+- Data Processing Agreement (DPA)
+- GDPR compliance documentation
+- Documentation: https://docs.escape.tech/
+
+**Key Questions:**
+- How long is API test data retained?
+- How long are vulnerability reports and scan results stored?
+- What is the data deletion policy?
+- Can customers request data deletion?
+- Data retention for API traffic logs
+- Data retention for discovered vulnerabilities
+- Backup retention periods
+
+### Data Sharing Policies
+**Status:** REQUIRES MANUAL VERIFICATION
+**Sources to Check:**
+- Privacy Policy: https://escape.tech/privacy
+- Subprocessor List
+- Third-party integrations documentation
+
+**Key Questions:**
+- Is API data shared with third parties?
+- Who are the subprocessors?
+- Is vulnerability data shared across Escape customers?
+- Are attack patterns aggregated/anonymized and shared?
+- What data is shared with integrations (CI/CD, issue trackers)?
+- Is any API data sent to external AI services (OpenAI, etc.)?
+
+### IP & Confidentiality Concerns
+**Status:** REQUIRES MANUAL VERIFICATION
+**Sources to Check:**
+- Terms of Service: https://escape.tech/terms
+- Enterprise Agreement
+- Intellectual Property Policy
+- Confidentiality provisions
+
+**Key Questions:**
+- Who owns the IP rights to pentest results?
+- Are there confidentiality protections for proprietary APIs?
+- What happens to API specifications during testing?
+- Are API endpoints and schemas stored?
+- How is sensitive data in API responses handled?
+- Are authentication tokens/credentials stored?
+- Are there NDA provisions for enterprise customers?
+- How are discovered vulnerabilities handled (disclosure policy)?
+
+---
+
+## Pricing & Plans
+
+### Free Tier
+**Status:** REQUIRES MANUAL VERIFICATION
+**Sources to Check:**
+- Pricing Page: https://escape.tech/pricing
+- Documentation: https://docs.escape.tech/
+
+**Information Needed:**
+- **Features Included:** Which testing modules (OWASP API Top 10, business logic, etc.)
+- **API Limits:** Number of APIs or endpoints that can be tested
+- **Scan Limits:** Number of scans per month
+- **User Limits:** Number of team members
+- **Duration:** Is it free forever, trial period, or limited time?
+- **Support Level:** Community, email, or no support?
+- **Test Depth:** Limited vs full penetration testing capabilities
+- **CI/CD Integration:** Available in free tier?
+
+### Paid Plans
+**Status:** REQUIRES MANUAL VERIFICATION
+**Sources to Check:**
+- Pricing Page: https://escape.tech/pricing
+- Contact sales for enterprise pricing
+
+**Plans to Document:**
+
+#### Starter/Developer Plan (if available)
+- **Cost:** $ per month or $ per API
+- **Features:** List key features
+- **Limits:** APIs, scans, users
+- **Support:** Level of support included
+- **Test Types:** Which vulnerability tests are included
+
+#### Professional/Team Plan (if available)
+- **Cost:** $ per month or $ per API
+- **Features:** Advanced testing capabilities
+- **Limits:** Higher limits or unlimited
+- **Support:** Priority support, SLA
+- **Additional:** Advanced reporting, custom rules
+
+#### Enterprise Plan
+- **Cost:** Custom pricing (contact sales)
+- **Features:** Full feature set, custom testing, white-glove service
+- **Limits:** Typically unlimited or very high
+- **Support:** Dedicated support, SLAs, CSM, direct Slack/Teams channel
+- **Additional:** Custom DPA, compliance certifications, on-premise deployment, air-gapped support
+- **Services:** Professional services, custom integrations, training
+
+---
+
+## Usage Limits
+
+### API Rate Limits
+**Status:** REQUIRES MANUAL VERIFICATION
+**Sources to Check:**
+- API Documentation: https://docs.escape.tech/api
+- Rate Limiting Documentation
+
+**Information Needed:**
+- API requests per hour/day to Escape platform
+- Different limits per plan tier
+- Rate limit for scanning customer APIs
+- Concurrent scan limits
+
+### API/Application Limits
+**Status:** REQUIRES MANUAL VERIFICATION
+**Information Needed:**
+- Number of APIs per organization
+- Number of endpoints per API
+- API specification size limits (OpenAPI, GraphQL schema size)
+- Limits vary by plan tier
+
+### Scan Limits
+**Status:** REQUIRES MANUAL VERIFICATION
+**Information Needed:**
+- Number of scans per month
+- Scan frequency (continuous vs scheduled)
+- Concurrent scan limits
+- Scan duration/timeout limits
+- Test depth limits (number of requests per scan)
+
+### User/Seat Limits
+**Status:** REQUIRES MANUAL VERIFICATION
+**Information Needed:**
+- Minimum seats for paid plans
+- Maximum team members
+- Read-only user limits
+- Guest/external user policies
+
+### Integration Limits
+**Status:** REQUIRES MANUAL VERIFICATION
+**Information Needed:**
+- Number of CI/CD integrations
+- Webhook delivery limits
+- Issue tracker integration limits
+
+---
+
+## Enterprise-Specific Considerations
+
+### Compliance & Certifications
+**Status:** REQUIRES MANUAL VERIFICATION
+**Sources to Check:**
+- Security/Trust page: https://escape.tech/security or https://escape.tech/trust
+- Compliance documentation
+
+**Check for:**
+- SOC 2 Type II certification
+- ISO 27001
+- GDPR compliance
+- CCPA compliance
+- PCI-DSS relevance (for payment API testing)
+- OWASP API Security Top 10 coverage
+- Penetration testing certifications (CREST, OSCP, etc.)
+
+### Deployment Options
+**Status:** REQUIRES MANUAL VERIFICATION
+**Check for:**
+- Cloud-hosted (SaaS) - standard offering
+- Self-hosted/on-premise options
+- Private cloud deployment
+- Air-gapped environment support (critical for pentesting)
+- Hybrid deployment (control plane cloud, scanning on-prem)
+- Data residency options (EU, US, etc.)
+
+### Security Features
+**Status:** REQUIRES MANUAL VERIFICATION
+**Check for:**
+- SSO/SAML support
+- SCIM provisioning
+- Role-based access control (RBAC)
+- Audit logging
+- Data encryption (in transit and at rest)
+- Two-factor authentication (2FA)
+- IP whitelisting
+- API key management
+- Secure credential storage for API authentication
+
+### Testing Capabilities
+**Status:** REQUIRES MANUAL VERIFICATION
+**Check for:**
+- OWASP API Security Top 10 coverage
+- Business logic testing
+- Authentication/authorization testing
+- Rate limiting testing
+- Input validation testing
+- GraphQL-specific tests
+- gRPC testing support
+- REST API testing
+- WebSocket testing
+- Custom rule creation
+- Compliance testing (PCI-DSS, HIPAA)
+
+### Integration Ecosystem
+**Status:** REQUIRES MANUAL VERIFICATION
+**Check for:**
+- CI/CD platforms (GitHub Actions, GitLab CI, Jenkins, CircleCI)
+- Issue trackers (Jira, Linear, GitHub Issues)
+- Communication (Slack, Microsoft Teams, email)
+- API Gateways (Kong, Apigee, AWS API Gateway)
+- Documentation platforms (Swagger, Postman)
+- Cloud providers (AWS, Azure, GCP)
+
+---
+
+## Research Checklist
+
+- [ ] Read complete privacy policy
+- [ ] Review terms of service
+- [ ] Check pricing page for current costs and plans
+- [ ] Review API documentation for rate limits
+- [ ] Check for Data Processing Agreement (DPA)
+- [ ] Verify GDPR/compliance information
+- [ ] Review documentation for deployment options
+- [ ] Check security/trust center for certifications
+- [ ] Test free tier if possible (understand sign-up requirements)
+- [ ] Contact sales for enterprise-specific information
+- [ ] Review integration documentation
+- [ ] Check for customer case studies or testimonials
+- [ ] Understand AI/ML capabilities and data usage
+- [ ] Review vulnerability disclosure policy
+- [ ] Check for bug bounty program
+
+---
+
+## Additional Resources
+
+- Documentation: https://docs.escape.tech/
+- Blog: https://escape.tech/blog
+- GitHub: Check for open-source components, examples, or client libraries
+- Status Page: Check for uptime/status page
+- Support: Check for support portal or contact information
+- Community: Discord, Slack, or forum
+
+---
+
+## Notes
+
+**Important Considerations for Escape:**
+1. **AI-Powered Testing:** Understand exactly how AI is used and what data feeds the models
+2. **API Data Sensitivity:** APIs often contain business-critical data - verify how test traffic is handled
+3. **Testing Production APIs:** Clarify if/how production API testing is supported safely
+4. **Authentication Handling:** Critical to understand how API credentials and tokens are managed
+5. **Vulnerability Disclosure:** Check if discovered vulnerabilities are reported externally or kept confidential
+6. **Test Traffic Generation:** Understand volume and nature of test requests sent to customer APIs
+7. **False Positive Rate:** Check if AI reduces false positives compared to traditional scanners
+8. **Schema Requirements:** Verify if OpenAPI/GraphQL schemas are required or if discovery is automatic
+
+**Critical Security Questions:**
+- Does pentesting generate traffic that could trigger rate limits or WAF rules?
+- How are API keys and credentials securely provided to the platform?
+- Is there a way to test staging/development environments only?
+- What happens if a critical vulnerability is discovered?
+- Are pentest results encrypted at rest?
+
+**Competitive Positioning:**
+- Compare to: StackHawk, Astra Security, Veracode, HCL AppScan
+- Note AI-specific advantages or limitations
+- Evaluate API-specific features vs general application security
+
+**Company Background:**
+- Verify company funding, stability, and reputation
+- Check for any security incidents in the past
+- Review customer testimonials specific to enterprise use
+
+**Last Updated:** [DATE TO BE ADDED AFTER RESEARCH]
+**Researcher:** [TO BE COMPLETED]
+**Verification Status:** Template - Requires Manual Research