ai_tools_analysis/evaluation_security_escape_updated.md

# Escape AI Pentesting - Enterprise Compatibility Evaluation

## Tool Overview
**Name:** Escape (by Escape Tech)
**Website:** https://escape.tech
**Category:** AI-Driven Dynamic Application Security Testing (DAST) for APIs
**Date Evaluated:** 2026-02-02

---

## Privacy & Enterprise Use

### Commercial/Enterprise Use Permission
**Status:** ✅ APPROVED FOR ENTERPRISE USE

**Key Findings:**
- Enterprise security vendor positioning
- Focus on API and web application pentesting
- Integration with CI/CD pipelines
- Designed for commercial use

### Model Training on User Data
**Status:** ✅ LIKELY SAFE (NO CODE UPLOAD REQUIRED)

**Key Findings:**
- **DAST (black-box testing) - NO source code uploaded**
- Tests running application from outside (like traditional pentesting)
- Generates attack traffic and logs responses
- No proprietary code directly exposed

**Data Handling:**
- Connects to running application or API
- May use API definition (OpenAPI/Swagger)
- Stores attack logs and discovered vulnerabilities
- Results kept confidential to your account

**Training Assumption:**
- No public policy stating customer data used for training
- Similar to other security scanners: likely trains on synthetic apps and known vulnerabilities
- Your specific app patterns not used globally
- May aggregate vulnerability statistics (anonymized)

### Data Retention Policies
**Status:** ⚠️ NOT PUBLICLY SPECIFIED

**Key Findings:**
- Pentest results stored on dashboard
- Logs of attacks and responses retained
- Specific retention period not disclosed
- Enterprise customers can likely negotiate terms
- Screenshots and exploit payloads stored for review

### Data Sharing Practices
**Status:** ✅ NO EXTERNAL SHARING (ASSUMED)

**Third-Party Sharing:**
- Results accessible only to your team
- No sharing between customers
- Data stays within Escape platform
- Vulnerability findings confidential

**Infrastructure:**
- Multi-region hosting mentioned
- Private deployment options available
- Single-tenant deployments for enterprise

### IP & Confidentiality Concerns
**Status:** ✅ GOOD (DAST APPROACH)

**Intellectual Property:**
- **No source code exposed** (DAST/black-box approach)
- Only observable API/web behavior tested
- You own all pentest results and findings
- No IP claims on discovered vulnerabilities

**Confidentiality:**
- Attack traffic is external (HTTP requests)
- Internal code/data not accessed
- Similar to hiring external pentester
- NDAs likely available for managed pentests

**Security Considerations:**
- Escape interacts with your app externally
- Only sees what any external attacker could see
- Does not access databases or internal systems
- Lower IP exposure risk than SAST tools

---

## Pricing & Plans

### Pricing Model
**Structure:** Enterprise SaaS subscription (custom pricing)

**Likely Based On:**
- Per-application pricing
- Number of API endpoints tested
- Frequency of scans (continuous vs periodic)
- Usage-based or subscription model

### Features
**Free Tier:** Possibly free trial or limited free scan

**Enterprise Features:**
- Continuous API security testing
- AI agents for logic flaw detection
- CI/CD integration
- Coverage screenshots and detailed logs
- Multi-region deployment options
- Support and training

### Usage Limits
- Lower tiers: Number of endpoints or scan frequency limited
- Enterprise: Unlimited or high-volume scanning

---

## Enterprise Compatibility Assessment

### Strengths ✅
- **DAST approach = minimal code exposure** (black-box testing)
- **No source code upload required**
- AI-driven testing finds complex logic flaws
- Multi-region and private deployment options
- Focus on API security (modern threat landscape)
- Lower IP risk than SAST tools

### Concerns ⚠️
- **Limited public documentation** on data handling
- Retention policies not transparent
- Training policies not explicitly stated
- Relatively newer player in market
- **Requires verification** before enterprise deployment

### Recommendations

**✅ PROVISIONALLY APPROVED WITH VERIFICATION**

**Why DAST is Lower Risk:**
- Only tests externally observable behavior
- No access to proprietary source code
- Similar risk profile to external pentesting
- Internal business logic not exposed

**Action Required BEFORE Use:**
1. **Request written confirmation:** App-specific data not used for training
2. **Clarify data retention:** Get vulnerability finding retention policies
3. **Review security:** Ensure findings stay confidential
4. **Test environment:** Use on staging/test environments first
5. **NDA:** Ensure confidentiality agreement covers findings

**Best For:**
- API security testing (REST, GraphQL, etc.)
- Organizations wanting AI-powered DAST
- Teams with modern cloud-native applications
- Continuous security testing in CI/CD

**Not Ideal For:**
- Testing production with real customer data (standard pentesting caution)
- Organizations requiring complete SAST + DAST (Escape is DAST only)
- Companies uncomfortable with any cloud-based security testing

**For Hack Days:**
- ✅ **SAFER THAN SAST TOOLS** - doesn't access source code
- Point it at test/staging environment
- Ensure test environment doesn't contain real customer data
- Monitor what endpoints are tested
- Review findings before wider deployment

### Comparison to Alternatives
- **vs SAST (Snyk Code, etc.):** Escape has LOWER IP exposure (no code upload)
- **vs Aikido:** Similar AI pentesting approach, similar verification needs
- **vs Traditional DAST:** Escape adds AI for logic flaw detection
- **vs Manual Pentesting:** Automated, continuous, more cost-effective

**Unique Advantage:** AI finds complex logic flaws that traditional scanners miss, without requiring source code access

---

## Sources & References

1. **ChatGPT Evaluation Report** - Escape AI analysis
2. **Escape Website**: https://escape.tech
3. **Industry Context**: DAST security testing standards

---

## Notes
- Last Updated: 2026-02-02
- Evaluator: Claude Code based on ChatGPT findings
- **Key Finding:** Escape's DAST approach means lower IP exposure than SAST tools (no source code upload)
- **Advantage:** Black-box testing approach naturally protects proprietary code
- **Status:** Provisionally approved with verification recommended

---

## DAST vs SAST - Privacy Comparison

### DAST (Escape, traditional scanners)
- ✅ **No source code uploaded**
- ✅ Tests external behavior only
- ✅ Lower IP exposure risk
- ⚠️ May miss internal code issues

### SAST (Snyk Code, etc.)
- ⚠️ Source code uploaded to cloud
- ✅ Finds internal code vulnerabilities
- ⚠️ Higher IP exposure risk (mitigated by no-training policies)
- ✅ Catches more vulnerability types

**For Maximum Privacy:** Use DAST (Escape) for external testing + On-prem SAST for internal scanning

---

## ⚠️ VERIFICATION CHECKLIST

Before using Escape:
- [ ] Request confirmation: App data not used for AI training
- [ ] Clarify: Vulnerability finding retention period
- [ ] Ensure: Test environment has no real customer data
- [ ] Verify: Results stay confidential to your team
- [ ] Check: NDA/confidentiality agreement available
- [ ] Review: Which endpoints/APIs will be tested

**Recommendation:** Escape is LOWER RISK than SAST tools for IP protection. Good choice for API security testing after basic verification.