initial

evaluation_security_escape_updated.md

@@ -0,0 +1,225 @@
+# Escape AI Pentesting - Enterprise Compatibility Evaluation
+
+## Tool Overview
+**Name:** Escape (by Escape Tech)
+**Website:** https://escape.tech
+**Category:** AI-Driven Dynamic Application Security Testing (DAST) for APIs
+**Date Evaluated:** 2026-02-02
+
+---
+
+## Privacy & Enterprise Use
+
+### Commercial/Enterprise Use Permission
+**Status:** ✅ APPROVED FOR ENTERPRISE USE
+
+**Key Findings:**
+- Enterprise security vendor positioning
+- Focus on API and web application pentesting
+- Integration with CI/CD pipelines
+- Designed for commercial use
+
+### Model Training on User Data
+**Status:** ✅ LIKELY SAFE (NO CODE UPLOAD REQUIRED)
+
+**Key Findings:**
+- **DAST (black-box testing) - NO source code uploaded**
+- Tests running application from outside (like traditional pentesting)
+- Generates attack traffic and logs responses
+- No proprietary code directly exposed
+
+**Data Handling:**
+- Connects to running application or API
+- May use API definition (OpenAPI/Swagger)
+- Stores attack logs and discovered vulnerabilities
+- Results kept confidential to your account
+
+**Training Assumption:**
+- No public policy stating customer data used for training
+- Similar to other security scanners: likely trains on synthetic apps and known vulnerabilities
+- Your specific app patterns not used globally
+- May aggregate vulnerability statistics (anonymized)
+
+### Data Retention Policies
+**Status:** ⚠️ NOT PUBLICLY SPECIFIED
+
+**Key Findings:**
+- Pentest results stored on dashboard
+- Logs of attacks and responses retained
+- Specific retention period not disclosed
+- Enterprise customers can likely negotiate terms
+- Screenshots and exploit payloads stored for review
+
+### Data Sharing Practices
+**Status:** ✅ NO EXTERNAL SHARING (ASSUMED)
+
+**Third-Party Sharing:**
+- Results accessible only to your team
+- No sharing between customers
+- Data stays within Escape platform
+- Vulnerability findings confidential
+
+**Infrastructure:**
+- Multi-region hosting mentioned
+- Private deployment options available
+- Single-tenant deployments for enterprise
+
+### IP & Confidentiality Concerns
+**Status:** ✅ GOOD (DAST APPROACH)
+
+**Intellectual Property:**
+- **No source code exposed** (DAST/black-box approach)
+- Only observable API/web behavior tested
+- You own all pentest results and findings
+- No IP claims on discovered vulnerabilities
+
+**Confidentiality:**
+- Attack traffic is external (HTTP requests)
+- Internal code/data not accessed
+- Similar to hiring external pentester
+- NDAs likely available for managed pentests
+
+**Security Considerations:**
+- Escape interacts with your app externally
+- Only sees what any external attacker could see
+- Does not access databases or internal systems
+- Lower IP exposure risk than SAST tools
+
+---
+
+## Pricing & Plans
+
+### Pricing Model
+**Structure:** Enterprise SaaS subscription (custom pricing)
+
+**Likely Based On:**
+- Per-application pricing
+- Number of API endpoints tested
+- Frequency of scans (continuous vs periodic)
+- Usage-based or subscription model
+
+### Features
+**Free Tier:** Possibly free trial or limited free scan
+
+**Enterprise Features:**
+- Continuous API security testing
+- AI agents for logic flaw detection
+- CI/CD integration
+- Coverage screenshots and detailed logs
+- Multi-region deployment options
+- Support and training
+
+### Usage Limits
+- Lower tiers: Number of endpoints or scan frequency limited
+- Enterprise: Unlimited or high-volume scanning
+
+---
+
+## Enterprise Compatibility Assessment
+
+### Strengths ✅
+- **DAST approach = minimal code exposure** (black-box testing)
+- **No source code upload required**
+- AI-driven testing finds complex logic flaws
+- Multi-region and private deployment options
+- Focus on API security (modern threat landscape)
+- Lower IP risk than SAST tools
+
+### Concerns ⚠️
+- **Limited public documentation** on data handling
+- Retention policies not transparent
+- Training policies not explicitly stated
+- Relatively newer player in market
+- **Requires verification** before enterprise deployment
+
+### Recommendations
+
+**✅ PROVISIONALLY APPROVED WITH VERIFICATION**
+
+**Why DAST is Lower Risk:**
+- Only tests externally observable behavior
+- No access to proprietary source code
+- Similar risk profile to external pentesting
+- Internal business logic not exposed
+
+**Action Required BEFORE Use:**
+1. **Request written confirmation:** App-specific data not used for training
+2. **Clarify data retention:** Get vulnerability finding retention policies
+3. **Review security:** Ensure findings stay confidential
+4. **Test environment:** Use on staging/test environments first
+5. **NDA:** Ensure confidentiality agreement covers findings
+
+**Best For:**
+- API security testing (REST, GraphQL, etc.)
+- Organizations wanting AI-powered DAST
+- Teams with modern cloud-native applications
+- Continuous security testing in CI/CD
+
+**Not Ideal For:**
+- Testing production with real customer data (standard pentesting caution)
+- Organizations requiring complete SAST + DAST (Escape is DAST only)
+- Companies uncomfortable with any cloud-based security testing
+
+**For Hack Days:**
+- ✅ **SAFER THAN SAST TOOLS** - doesn't access source code
+- Point it at test/staging environment
+- Ensure test environment doesn't contain real customer data
+- Monitor what endpoints are tested
+- Review findings before wider deployment
+
+### Comparison to Alternatives
+- **vs SAST (Snyk Code, etc.):** Escape has LOWER IP exposure (no code upload)
+- **vs Aikido:** Similar AI pentesting approach, similar verification needs
+- **vs Traditional DAST:** Escape adds AI for logic flaw detection
+- **vs Manual Pentesting:** Automated, continuous, more cost-effective
+
+**Unique Advantage:** AI finds complex logic flaws that traditional scanners miss, without requiring source code access
+
+---
+
+## Sources & References
+
+1. **ChatGPT Evaluation Report** - Escape AI analysis
+2. **Escape Website**: https://escape.tech
+3. **Industry Context**: DAST security testing standards
+
+---
+
+## Notes
+- Last Updated: 2026-02-02
+- Evaluator: Claude Code based on ChatGPT findings
+- **Key Finding:** Escape's DAST approach means lower IP exposure than SAST tools (no source code upload)
+- **Advantage:** Black-box testing approach naturally protects proprietary code
+- **Status:** Provisionally approved with verification recommended
+
+---
+
+## DAST vs SAST - Privacy Comparison
+
+### DAST (Escape, traditional scanners)
+- ✅ **No source code uploaded**
+- ✅ Tests external behavior only
+- ✅ Lower IP exposure risk
+- ⚠️ May miss internal code issues
+
+### SAST (Snyk Code, etc.)
+- ⚠️ Source code uploaded to cloud
+- ✅ Finds internal code vulnerabilities
+- ⚠️ Higher IP exposure risk (mitigated by no-training policies)
+- ✅ Catches more vulnerability types
+
+**For Maximum Privacy:** Use DAST (Escape) for external testing + On-prem SAST for internal scanning
+
+---
+
+## ⚠️ VERIFICATION CHECKLIST
+
+Before using Escape:
+- [ ] Request confirmation: App data not used for AI training
+- [ ] Clarify: Vulnerability finding retention period
+- [ ] Ensure: Test environment has no real customer data
+- [ ] Verify: Results stay confidential to your team
+- [ ] Check: NDA/confidentiality agreement available
+- [ ] Review: Which endpoints/APIs will be tested
+
+**Recommendation:** Escape is LOWER RISK than SAST tools for IP protection. Good choice for API security testing after basic verification.