olegs/ai_tools_analysis
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
eedbebe3b425d01886601776504129c008a5b6f2
ai_tools_analysis/evaluation_security_escape.md
T
olegs 6c65691b2e initial
2026-02-02 13:41:43 +02:00

11 KiB
Raw Blame History

Security AI Tool Evaluation: Escape AI Pentesting

Tool Overview

Name: Escape (formerly Escape.tech) Type: AI-Powered API Security & Pentesting Platform Website: https://escape.tech Primary Function: Automated API security testing, vulnerability scanning, penetration testing for APIs (REST, GraphQL, gRPC)

Privacy Policy & Enterprise Compatibility

Commercial/Enterprise Use Permission

Status: REQUIRES MANUAL VERIFICATION Sources to Check:

Key Questions:

  • Does the privacy policy explicitly permit commercial use?
  • Are there any restrictions on enterprise deployment?
  • What is the licensing model for commercial use?
  • Any restrictions on testing production APIs?
  • Any geographic restrictions?

Data Training & Model Use

Status: REQUIRES MANUAL VERIFICATION Sources to Check:

Key Questions:

  • Is customer API data used to train or improve AI models?
  • How does the AI-powered pentesting work?
  • Can customers opt out of data collection for model training?
  • What API data is collected during testing (endpoints, payloads, responses)?
  • Are test results used to improve detection algorithms?
  • Is any data anonymized and aggregated for ML training?
  • How are API schemas and specifications handled?

Data Retention Policies

Status: REQUIRES MANUAL VERIFICATION Sources to Check:

Key Questions:

  • How long is API test data retained?
  • How long are vulnerability reports and scan results stored?
  • What is the data deletion policy?
  • Can customers request data deletion?
  • Data retention for API traffic logs
  • Data retention for discovered vulnerabilities
  • Backup retention periods

Data Sharing Policies

Status: REQUIRES MANUAL VERIFICATION Sources to Check:

Key Questions:

  • Is API data shared with third parties?
  • Who are the subprocessors?
  • Is vulnerability data shared across Escape customers?
  • Are attack patterns aggregated/anonymized and shared?
  • What data is shared with integrations (CI/CD, issue trackers)?
  • Is any API data sent to external AI services (OpenAI, etc.)?

IP & Confidentiality Concerns

Status: REQUIRES MANUAL VERIFICATION Sources to Check:

Key Questions:

  • Who owns the IP rights to pentest results?
  • Are there confidentiality protections for proprietary APIs?
  • What happens to API specifications during testing?
  • Are API endpoints and schemas stored?
  • How is sensitive data in API responses handled?
  • Are authentication tokens/credentials stored?
  • Are there NDA provisions for enterprise customers?
  • How are discovered vulnerabilities handled (disclosure policy)?

Pricing & Plans

Free Tier

Status: REQUIRES MANUAL VERIFICATION Sources to Check:

Information Needed:

  • Features Included: Which testing modules (OWASP API Top 10, business logic, etc.)
  • API Limits: Number of APIs or endpoints that can be tested
  • Scan Limits: Number of scans per month
  • User Limits: Number of team members
  • Duration: Is it free forever, trial period, or limited time?
  • Support Level: Community, email, or no support?
  • Test Depth: Limited vs full penetration testing capabilities
  • CI/CD Integration: Available in free tier?

Paid Plans

Status: REQUIRES MANUAL VERIFICATION Sources to Check:

Plans to Document:

Starter/Developer Plan (if available)

  • Cost: per month or per API
  • Features: List key features
  • Limits: APIs, scans, users
  • Support: Level of support included
  • Test Types: Which vulnerability tests are included

Professional/Team Plan (if available)

  • Cost: per month or per API
  • Features: Advanced testing capabilities
  • Limits: Higher limits or unlimited
  • Support: Priority support, SLA
  • Additional: Advanced reporting, custom rules

Enterprise Plan

  • Cost: Custom pricing (contact sales)
  • Features: Full feature set, custom testing, white-glove service
  • Limits: Typically unlimited or very high
  • Support: Dedicated support, SLAs, CSM, direct Slack/Teams channel
  • Additional: Custom DPA, compliance certifications, on-premise deployment, air-gapped support
  • Services: Professional services, custom integrations, training

Usage Limits

API Rate Limits

Status: REQUIRES MANUAL VERIFICATION Sources to Check:

Information Needed:

  • API requests per hour/day to Escape platform
  • Different limits per plan tier
  • Rate limit for scanning customer APIs
  • Concurrent scan limits

API/Application Limits

Status: REQUIRES MANUAL VERIFICATION Information Needed:

  • Number of APIs per organization
  • Number of endpoints per API
  • API specification size limits (OpenAPI, GraphQL schema size)
  • Limits vary by plan tier

Scan Limits

Status: REQUIRES MANUAL VERIFICATION Information Needed:

  • Number of scans per month
  • Scan frequency (continuous vs scheduled)
  • Concurrent scan limits
  • Scan duration/timeout limits
  • Test depth limits (number of requests per scan)

User/Seat Limits

Status: REQUIRES MANUAL VERIFICATION Information Needed:

  • Minimum seats for paid plans
  • Maximum team members
  • Read-only user limits
  • Guest/external user policies

Integration Limits

Status: REQUIRES MANUAL VERIFICATION Information Needed:

  • Number of CI/CD integrations
  • Webhook delivery limits
  • Issue tracker integration limits

Enterprise-Specific Considerations

Compliance & Certifications

Status: REQUIRES MANUAL VERIFICATION Sources to Check:

Check for:

  • SOC 2 Type II certification
  • ISO 27001
  • GDPR compliance
  • CCPA compliance
  • PCI-DSS relevance (for payment API testing)
  • OWASP API Security Top 10 coverage
  • Penetration testing certifications (CREST, OSCP, etc.)

Deployment Options

Status: REQUIRES MANUAL VERIFICATION Check for:

  • Cloud-hosted (SaaS) - standard offering
  • Self-hosted/on-premise options
  • Private cloud deployment
  • Air-gapped environment support (critical for pentesting)
  • Hybrid deployment (control plane cloud, scanning on-prem)
  • Data residency options (EU, US, etc.)

Security Features

Status: REQUIRES MANUAL VERIFICATION Check for:

  • SSO/SAML support
  • SCIM provisioning
  • Role-based access control (RBAC)
  • Audit logging
  • Data encryption (in transit and at rest)
  • Two-factor authentication (2FA)
  • IP whitelisting
  • API key management
  • Secure credential storage for API authentication

Testing Capabilities

Status: REQUIRES MANUAL VERIFICATION Check for:

  • OWASP API Security Top 10 coverage
  • Business logic testing
  • Authentication/authorization testing
  • Rate limiting testing
  • Input validation testing
  • GraphQL-specific tests
  • gRPC testing support
  • REST API testing
  • WebSocket testing
  • Custom rule creation
  • Compliance testing (PCI-DSS, HIPAA)

Integration Ecosystem

Status: REQUIRES MANUAL VERIFICATION Check for:

  • CI/CD platforms (GitHub Actions, GitLab CI, Jenkins, CircleCI)
  • Issue trackers (Jira, Linear, GitHub Issues)
  • Communication (Slack, Microsoft Teams, email)
  • API Gateways (Kong, Apigee, AWS API Gateway)
  • Documentation platforms (Swagger, Postman)
  • Cloud providers (AWS, Azure, GCP)

Research Checklist

  • Read complete privacy policy
  • Review terms of service
  • Check pricing page for current costs and plans
  • Review API documentation for rate limits
  • Check for Data Processing Agreement (DPA)
  • Verify GDPR/compliance information
  • Review documentation for deployment options
  • Check security/trust center for certifications
  • Test free tier if possible (understand sign-up requirements)
  • Contact sales for enterprise-specific information
  • Review integration documentation
  • Check for customer case studies or testimonials
  • Understand AI/ML capabilities and data usage
  • Review vulnerability disclosure policy
  • Check for bug bounty program

Additional Resources

  • Documentation: https://docs.escape.tech/
  • Blog: https://escape.tech/blog
  • GitHub: Check for open-source components, examples, or client libraries
  • Status Page: Check for uptime/status page
  • Support: Check for support portal or contact information
  • Community: Discord, Slack, or forum

Notes

Important Considerations for Escape:

  1. AI-Powered Testing: Understand exactly how AI is used and what data feeds the models
  2. API Data Sensitivity: APIs often contain business-critical data - verify how test traffic is handled
  3. Testing Production APIs: Clarify if/how production API testing is supported safely
  4. Authentication Handling: Critical to understand how API credentials and tokens are managed
  5. Vulnerability Disclosure: Check if discovered vulnerabilities are reported externally or kept confidential
  6. Test Traffic Generation: Understand volume and nature of test requests sent to customer APIs
  7. False Positive Rate: Check if AI reduces false positives compared to traditional scanners
  8. Schema Requirements: Verify if OpenAPI/GraphQL schemas are required or if discovery is automatic

Critical Security Questions:

  • Does pentesting generate traffic that could trigger rate limits or WAF rules?
  • How are API keys and credentials securely provided to the platform?
  • Is there a way to test staging/development environments only?
  • What happens if a critical vulnerability is discovered?
  • Are pentest results encrypted at rest?

Competitive Positioning:

  • Compare to: StackHawk, Astra Security, Veracode, HCL AppScan
  • Note AI-specific advantages or limitations
  • Evaluate API-specific features vs general application security

Company Background:

  • Verify company funding, stability, and reputation
  • Check for any security incidents in the past
  • Review customer testimonials specific to enterprise use

Last Updated: [DATE TO BE ADDED AFTER RESEARCH] Researcher: [TO BE COMPLETED] Verification Status: Template - Requires Manual Research

Reference in new issue View Git Blame Copy Permalink