Sold by: Escape
Run continuous, AI-powered pentesting assessments with exploitability proof and reporting auditors and your engineers will both actually act on.
4.9
Overview
Image
Turn bug bounty reports into regression tests
Image
AI Pentesting Agents
Image
Attack Path Validation & Remediation
Annual pentests are point-in-time by design. Your engineering org isn't.
Escape AI Pentesting runs continuous, agentic security assessments on web apps and APIs, finding multi-step attack chains the way a human pentester would, but at the scale of a CI pipeline. Offensive security shifts from a budget line item to a quality gate inside engineering.
What you get with Escape AI Pentesting
-
Human-like testing, machine-like scale. Agentic attack reasoning powered by graph context finds complex multi-step attack chains across business logic, auth flows, and authorization boundaries. One Head of Application and Offensive Security at a large multinational reported 393% ROI.
-
Proof that gets engineering to move. Every finding ships with the exact agentic reasoning trace: the graph path, the request chain, the working exploit, and a fix tailored to the dev framework. Customers report 80% reduction in time-to-remediation versus manual or semi-manual processes. Engineers stop questioning severity and start fixing.
-
Bug bounty to code fix, no human needed. Feed in findings from bug bounty reports or manual pentests. Escape converts them into automated regression tests that run on every build, going from file upload to organization-wide testing in under an hour. The same vulnerability never ships twice.
-
Compliance-ready by design. PCI-DSS application testing on every significant change. SOC 2 and ISO 27001 documented assessments. Detailed reporting and audit trails with no human in the loop.
-
Public and private environments. Hybrid cloud and on-prem deployments mean you can run assessments on internal apps without giving access to external consultants or bug hunters.
-
Multiplies your existing stack. Findings flow into Wiz with full risk-prioritization context. Tickets, IDE fixes, and chat workflows route to the right engineer with the working exploit attached.
Highlights
- Traditional pentests are point-in-time by design. Agentic attack reasoning powered by Graph context allows Escape to find even complex multi-step attack chains. You can run in-depth security assessments on every release cycle, so vulnerabilities get caught before production. Transform offensive security from a budget line into a quality gate.
- Engineers don't fix "we found a BOLA - use OWASP guidelines". They fix "here's exactly how an attacker exploited this, here's the request chain, here's the fix for your framework." Escape delivers both.
- Feed in findings from bug bounty programs or manual pentest reports. Escape converts them into automated regression tests that run on every build. The same vulnerability never ships twice, and your security posture compounds instead of resetting.
Details
New
Introducing multi-product solutions
You can now purchase comprehensive solutions tailored to use cases and industries.
Features and programs
Trust Center
Access real-time vendor security and compliance information through their Trust Center powered by Drata or Vanta. Review certifications and security standards before purchase.
Financing for AWS Marketplace purchases
AWS Marketplace now accepts line of credit payments through the PNC Vendor Finance program. This program is available to select AWS customers in the US, excluding NV, NC, ND, TN, & VT.
Pricing
Pricing is based on the duration and terms of your contract with the vendor. This entitles you to a specified quantity of use for the contract duration. If you choose not to renew or replace your contract before it ends, access to these entitlements will expire.
Additional AWS infrastructure costs may apply. Use the AWS Pricing Calculator to estimate your infrastructure costs.
Dimension | Description | Cost/12 months |
|---|---|---|
On-Demand AI-Powered Pentest | Agentic pentesting on demand, possible regression test ingestion, coverage for multiple multi-step attack scenarios, generation of code-level fixes tailored to the development framework, and automated custom reporting per the required compliance framework. Can be used anytime up to 12 months after purchase. | $3,000.00 |
Dimensions summary
This listing offers a single pricing dimension: On-Demand AI-Powered Pentest, billed by units under a contract model. You buy units up front and draw from them anytime within 12 months of purchase. Pricing scales with the number of units you consume rather than a fixed subscription. Each unit covers an agentic pentest that can ingest regression tests, run multi-step attack scenarios, generate code-level fixes for your development framework, and produce automated reports for your compliance needs. Because there is one option, you scale spend by adjusting the quantity of units purchased.
Top-of-mind questions for buyers
A unit represents the billing measure you draw down when you launch an agentic pentest. The marketplace listing defines the scope each unit covers but does not tie a unit to a fixed asset count. Confirm with the vendor exactly how many assets or scenarios one unit covers for your environment.
Each pentest runs agentic testing that can ingest regression tests and probe multiple multi-step attack scenarios. It generates code-level fixes matched to your development framework. It also produces automated reports aligned to your required compliance framework. These capabilities apply to the on-demand runs you fund with your purchased units.
You buy units up front under a contract. You can draw from them anytime within 12 months of purchase. Charges reflect the number of units you buy, not a recurring monthly fee. You run pentests on your own schedule rather than paying for a fixed interval.
escape.tech
Helpful?
Vendor refund policy
Refunds are not generally provided for AWS Marketplace contract purchases. For billing disputes or service issues, contact support@escape.tech within 30 days of subscription start.
Legal
Vendor terms and conditions
Upon subscribing to this product, you must acknowledge and agree to the terms and conditions outlined in the vendor's End User License Agreement (EULA) .
Content disclaimer
Vendors are responsible for their product descriptions and other product content. AWS does not warrant that vendors' product descriptions or other product content are accurate, complete, reliable, current, or error-free.
Delivery details
Software as a Service (SaaS)
SaaS delivers cloud-based software applications directly to customers over the internet. You can access these applications through a subscription model. You will pay recurring monthly usage fees through your AWS bill, while AWS handles deployment and infrastructure management, ensuring scalability, reliability, and seamless integration with other AWS services.
Resources
Support
Vendor support
For any inquiries, kindly reach out to us through your designated support channel or via email at support@escape.tech . You can also make use of our in-app live messaging feature within the Escape platform for real-time assistance.
AWS infrastructure support
AWS Support is a one-on-one, fast-response support channel that is staffed 24x7x365 with experienced and technical support engineers. The service helps customers of all sizes and technical abilities to successfully utilize the products and features provided by Amazon Web Services.
Similar products
AI-powered DAST that easily integrates with your modern stack, finds even the most complex issues, and helps developers with remediation.
Designed from the ground up by Escape Technology, Sherpa is a simple-to-use cloud-resource management tool ideally suited to creative teams looking to leverage the power of AWS. Sherpa provides a unified, user-friendly platform that empowers businesses to maximize the potential of their AWS cloud investments while minimizing operational overhead.
Discover and validate exposure of modern apps, APIs, and AI services across your entire distributed engineering org in real time. From code to cloud.
Realize savings on your on-premise VMware deployment and transform your infrastructure at the same time at little to no cost. IO Connect Services evaluates your entire VMware implementation, its associated licensing, and infrastructure to develop your VMware to cloud migration, modernization, and transformation readiness roadmap. As an AWS Advanced Technology Partner, skilled in migration, integration and transformation IO Connect will perform a VMware Specific Migration Readiness (MRA), solidified in AWS best practices, delivering financial and technological recommendations in under two weeks for potential in-year savings upwards of 43%.
Customer reviews
Varun S.
Fast, Transparent DAST with Excellent GraphQL Handling and Strong Support
Reviewed on Jun 18, 2026
Review provided by G2
What do you like best about the product?
Escape is built with a wide range of protocols in mind and shows a strong understanding of how they work. In particular, I really liked how it handles GraphQL operations. I’ve gotten better results than with traditional DASTs.
The UI/UX offers a lot of transparency into what the tool is doing and how it reports issues. Filtering is excellent, and it’s easy to adapt it to whatever prioritization matrix you use. Scans are also quick.
Escape comes with the baseline integrations you need from day one. It covers the same integrations you’d expect from other DAST platforms, and the team is quick to work with you on new ones when there’s enough interest and it improves the overall experience.
Support has been consistently strong: they typically respond within half a day and do a great job helping resolve issues. They’re also willing to jump on calls to debug and fix things together.
Escape's AI Copilot is great on its own, but if you want to extend it further, you can use Escape MCP with other AI tools to build your own triage pipelines with custom context and knowledge.
I was an early adopter of Escape, and their pricing has been fair since day one.
The UI/UX offers a lot of transparency into what the tool is doing and how it reports issues. Filtering is excellent, and it’s easy to adapt it to whatever prioritization matrix you use. Scans are also quick.
Escape comes with the baseline integrations you need from day one. It covers the same integrations you’d expect from other DAST platforms, and the team is quick to work with you on new ones when there’s enough interest and it improves the overall experience.
Support has been consistently strong: they typically respond within half a day and do a great job helping resolve issues. They’re also willing to jump on calls to debug and fix things together.
Escape's AI Copilot is great on its own, but if you want to extend it further, you can use Escape MCP with other AI tools to build your own triage pipelines with custom context and knowledge.
I was an early adopter of Escape, and their pricing has been fair since day one.
What do you dislike about the product?
I’m mostly going to nitpick here.
Escape could elevate the UX tremendously and connect its offerings more cohesively. It supports GraphQL schema files, but there’s no way to automate schema file updates. It would be a huge help if it had GitHub integration so it could automatically discover and pull schema files.
Similarly, Escape Copilot is great at reasoning with the information that’s available, but that alone isn’t enough for me to fully trust its reasoning when the goal is to reduce triage time.
Right now, I run custom pipelines via Escape’s MCP for triage agents, using my own code knowledge for correlation. If they introduce GitHub integration, they could leverage it to provide better triage outcomes.
They could also improve the UX around load times. The platform takes a while to load pages and profiles.
Lastly, Escape could improve their APIs & other component with customer side automations in mind. Escape generate good reports but there is no automated way to export those as PDFs. You have to manually fetch the data via API and format it where the escape insights and presentation is lost.
Escape could elevate the UX tremendously and connect its offerings more cohesively. It supports GraphQL schema files, but there’s no way to automate schema file updates. It would be a huge help if it had GitHub integration so it could automatically discover and pull schema files.
Similarly, Escape Copilot is great at reasoning with the information that’s available, but that alone isn’t enough for me to fully trust its reasoning when the goal is to reduce triage time.
Right now, I run custom pipelines via Escape’s MCP for triage agents, using my own code knowledge for correlation. If they introduce GitHub integration, they could leverage it to provide better triage outcomes.
They could also improve the UX around load times. The platform takes a while to load pages and profiles.
Lastly, Escape could improve their APIs & other component with customer side automations in mind. Escape generate good reports but there is no automated way to export those as PDFs. You have to manually fetch the data via API and format it where the escape insights and presentation is lost.
What problems is the product solving and how is that benefiting you?
I’m using Escape to close the gaps in our current DAST coverage as Sigma becomes more API-first and GraphQL-heavy. Previous tool was falling short for me on GraphQL support, authenticated and logic-aware testing, and CI/CD integration, which meant weaker coverage for issues like BOLA/IDOR and multi-step workflow flaws.
Escape helps me by giving me better coverage across the surfaces I actually care about - our GraphQL backends, APIs, and web apps - with native GraphQL discovery, authenticated and multi-user scanning, internal scanning through private locations, and more context-aware vulnerability detection.
The practical benefit to me is that I can get broader coverage, higher-fidelity findings, and better operational fit. I’m expecting fewer false positives, better signal for developers, and tighter integration with our existing workflows so security testing is less of a bottleneck.
Escape helps me by giving me better coverage across the surfaces I actually care about - our GraphQL backends, APIs, and web apps - with native GraphQL discovery, authenticated and multi-user scanning, internal scanning through private locations, and more context-aware vulnerability detection.
The practical benefit to me is that I can get broader coverage, higher-fidelity findings, and better operational fit. I’m expecting fewer false positives, better signal for developers, and tighter integration with our existing workflows so security testing is less of a bottleneck.
Information Technology and Services
Excellent DAST disruptor
Reviewed on Sep 11, 2025
Review provided by G2
What do you like best about the product?
Escape has an excellent modern approach to DAST testing making it easy to manage complex single threaded scans. One of the nicest/underated features is the screen capturing in scan logs allowing teams to quickly validate if authentication has occured and to assess product coverage.
What do you dislike about the product?
Since it is a start up there are some features missing but they have added them to the roadmap and quickly iterate through version based on user feedback a rarity in a stagnant market.
What problems is the product solving and how is that benefiting you?
It solves complex single thread authentication scanning and creates simplicity to DAST scanning which no other vendor was able to provide for us.
Financial Services
API security : inventory & security checks made easy!
Reviewed on Feb 19, 2025
Review provided by G2
What do you like best about the product?
Easy to setup
Easy to integrate to your CI/CD
Public and private internal APIs supported
Nice advices and examples for your developers to address issues
Capacity to create workflows
Easy to integrate to your CI/CD
Public and private internal APIs supported
Nice advices and examples for your developers to address issues
Capacity to create workflows
What do you dislike about the product?
Small company, which could block the purchasing process in some large companies.
Not yet recognized company even if their product is great
Not yet recognized company even if their product is great
What problems is the product solving and how is that benefiting you?
Help identifying vulnerabilities or coding errors continually in our APIs and propose solutions to our developpers.
Nobuyuki I.
Best API security testing tool in the world!
Reviewed on Feb 17, 2025
Review provided by G2
What do you like best about the product?
We have been using Escape platform for a couple years since the beginning of their product.
It effectively addresses the pain points in API security management!
The tool excels in detecting a wide range of API vulnerabilities, including business logic flaws often missed by other solutions.
It effectively addresses the pain points in API security management!
The tool excels in detecting a wide range of API vulnerabilities, including business logic flaws often missed by other solutions.
What do you dislike about the product?
The updates to the platform, while ensuring we always have access to the latest features and security enhancements, can sometimes require a bit of adjustment on our part.
Nevertheless, the benefits of the tool far outweigh this minor inconvenience, and we look forward to seeing how the platform evolves to balance innovation with user familiarity.
Nevertheless, the benefits of the tool far outweigh this minor inconvenience, and we look forward to seeing how the platform evolves to balance innovation with user familiarity.
What problems is the product solving and how is that benefiting you?
We usually build AWS serverless applications for many clients, but we do not have experienced security engineers in our team that's where Escape platform helps us a lot.
Reporting to the client becomes much easier as well, we want to apply Escape security testing to upcoming projects as a standard security assesments
Reporting to the client becomes much easier as well, we want to apply Escape security testing to upcoming projects as a standard security assesments
Information Technology and Services
API Security with Escape
Reviewed on Jan 30, 2025
Review provided by G2
What do you like best about the product?
Easy to integrate. Helped to quickly check and make sure our GraphQL endpoints were secure.
Great customer support as well.
Great customer support as well.
What do you dislike about the product?
No complaints here. Worked great for us.
What problems is the product solving and how is that benefiting you?
It is helping us make sure our API security is up to date.