Escape - Application Security & Offensive Security Blog
Explore practical offensive and application security insights covering web application testing, emerging AI cybersecurity research, API and GraphQL security, and advanced testing techniques.
Filters
Application Security
What is business logic, and why it's important for application security
Is understanding business logic a critical component of application security? Absolutely. In the world of cybersecurity, business logic is more than just a set of operational directives. It serves as the crucial bridge between an application's technical function and its alignment with strategic business goals.
More than that,
6 min read
Webinar: Best Practices for Security Compliance
How can you turn compliance from a box-ticking exercise into a strategic advantage for your organization?
Join our upcoming webinar with DevSecOps expert, Wilson Mar, and get insights you need to optimize your approach to security compliance.
😔Unfortunately, this webinar has been canceled until further notice. One of our hosts
1 min read
Pentesting
Different types of penetration testing
Penetration testing, commonly known as pentesting, involves simulating a real attack on a server to assess its vulnerabilities against potential real-world attacks. While the primary goal is to emulate concrete threats, pentesting can extend beyond, offering insights into the potential consequences if confidential data were to fall into malicious hackers&
11 min read
Application Security
SAST vs DAST: how to make the choice and combine them effectively
Should you choose between SAST and DAST? Perhaps the real question is, why not use both in your application security strategy? Let's be honest—vulnerabilities are often discovered when it's too late. No matter how well developers follow secure coding guidelines, it's impossible to
8 min read
Application Security
Vulnerability Management Lifecycle: 5 Steps and Best Practices
Maintaining robust security of your organization is not just crucial in 2023 – it's a survival strategy. The recent data breach at 23andMe in October 2023 is a case in point. This incident, where a credential-stuffing attack led to unauthorized access to customer accounts, underscores a harsh reality. Even
15 min read
API Security
Introducing your new API security testing assistant: Meet our GPT Bot!
Hey there 👋 We've got some exciting news to share with you today!
We're thrilled to introduce you to our brand-new API security testing assistant: the GPT Bot "API Guardian".
Are you tired of spending endless hours proactively looking for the best practices to test
6 min read
Events
Webinar: Building Your Product Security Roadmap
Whether you're in the first few weeks of your ProdSec journey or building your Product security program for 2024, you might feel lost trying to wrap your head around all the attack surface your org faces and identifying some of the biggest security gaps. Don't worry,
1 min read
Case Study
Case Study: How Lightspeed ensures full security compliance with Escape
Lightspeed, a technology partner to more than 160,000 global retail and hospitality businesses, has recently transitioned to a centralized payments model and adopted GraphQL APIs as a cornerstone of its operations. GraphQL allowed Lightspeed to improve both efficiency and flexibility in data retrieval, resulting in better overall system performance.
3 min read
Application Security
How to establish an application security policy
As organizations increasingly rely on web and mobile applications to conduct business, robust application security has become paramount. Cyberattacks are on the rise, and without adequate protection, businesses risk losing sensitive data, revenue, and reputational damage. Having an application security policy in place is the first line of defense against
14 min read
DevSecOps
DevOps vs DevSecOps: exploring the key differences and how to make the shift
Companies are constantly searching for ways to deliver high-quality products quickly and efficiently. The evolution of DevOps revolutionized the industry by merging development and operations teams, breaking down silos, and fostering collaboration and communication.
However, as startups and businesses strive for agility and speed, security often falls by the wayside.
9 min read
API Security
Escape API Security Checklist
Are you looking to make your API security program stronger? Do you sometimes find it challenging to spot and address security vulnerabilities effectively? You're not alone! Many security professionals like you face challenges in improving API security because technology and cyber threats keep changing. This makes ensuring strong
1 min read
Competitor Comparison
Escape vs 42Crunch: A Complete Comparison 2025
Today, attackers prioritize exploiting an application's business logic flaws and API vulnerabilities, which may result in the unauthorized extraction of sensitive data. Understanding an application's business logic is challenging, and requires a security platform that comprehends an application's functionalities to address complex API attacks.
7 min read
API Discovery
What is API discovery, and how does it work?
Ever wondered how applications effortlessly communicate and collaborate, seamlessly sharing data and functionalities? Enter API discovery – the game-changer in modern development. What if finding and connecting with APIs was as intuitive as flipping a switch?
As the newly appointed security engineer, you quickly realize the sprawling web of APIs that
6 min read
AppSec
Application security audit: an in-depth guide
Introduction
What are application security audits?
In information technologies departments, application security audits are systematic evaluations conducted to assess the security posture of an organization's applications.
Application security audits involve finding possible threats and determining the organization's attack surface. The different vectors that attackers can leverage
7 min read
API Security
Introducing business logic security testing for REST APIs
After one year and a half of approaching API security through the lenses of GraphQL, we are proud to introduce full support for REST API Security Testing in Escape, in addition to GraphQL 🚀
You like us on GraphQL. You will love us on REST.
It's been a ride
3 min read
DevSecOps
How to automate and secure deployment within GitLab CI with Syft and Grype
Ensuring the security of your code is paramount in today's fast-paced development landscape. Thankfully, the automation capabilities of CI/CD pipelines can make this process seamless. In this article, we'll guide you through setting up a GitLab CI pipeline that automates code security checks, allowing you
7 min read
Announcement
October Spotlight: The major events not to be missed
If you’re not yet convinced that the fall is the best season to attend cybersecurity conferences, our upcoming event lineup might change your mind!
This month, we're taking our team global, from the US to Monaco, Canada to Sweden. Are you planning to soak up the sun
3 min read
Don’t let your vulnerabilities escape.
Ready to multiply your force, not just noise?
Book a demo
Book a demo