Escape

First, it addresses GraphQL APIs by enabling easy integration of their armour library. After pen testing, each issue comes with effective remediation guidance, saving time spent searching the web for fixes. Customer support is highly responsive and always available when needed. One issue during pen testing involved a timeout, but the remediation wasn't provided in GraphQL Armour; implementing that could complete the security coverage. Our security posture improved from 3% to over 75% after using their open-source library and remediation advice.

This is a great app for supporting security and IT, and it's easy to use. I liked the interface and how it simplifies my work. There is a learning curve, and it took some time to become comfortable with it. It helps in the evolving landscape of AI and technology, detecting issues and security risks more rapidly.

Escape addressed a gap in our AppSec program that our current tool couldn't handle. It integrated seamlessly with our existing tools and quickly secured our GraphQL endpoints. So far, no complaints—I wish we'd found it sooner. It's delivering GraphQL security for us.

Finding an effective security tool for GraphQL was challenging, so I was thrilled to discover the Escape scanner. It's an excellent fit for protecting our GraphQL endpoints, and I'm very impressed with how it operates overall. While user-friendly features are still in development, the core functionality is definitely present. This is about GraphQL security.

Escape is extremely user-friendly and simple to set up. I really appreciate the ability to run continuous scans to confirm that identified issues have been resolved. The support team is fantastic and works diligently to deliver the best possible product. I do wish Escape could handle large GraphQL schemas, but they're releasing new features with more horsepower to address that. Escape is uncovering vulnerabilities in our GraphQL API. Since humans can only do so much, having a tool that assists me is a huge advantage.

Integration was simple, and it quickly helped us verify the security of our GraphQL endpoints. Customer support has been excellent as well. No complaints here; it worked perfectly for us and ensures our API security remains up to date.

Setting up is straightforward, and integrating into CI/CD is simple. It supports both public and private internal APIs. The advice and examples it provides for developers to resolve issues are helpful, and it has the capability to create custom workflows. Being a smaller company might impede procurement in larger organizations, and it's not yet widely recognized even though its product is excellent. It aids in continuously detecting vulnerabilities or coding errors in our APIs and offers solutions to our developers.

We've been leveraging Escape for a couple of years since its inception. It effectively resolves our API security management challenges! The tool is excellent at identifying a broad spectrum of API vulnerabilities, including business logic flaws that other solutions often overlook. Platform updates ensure we always have the latest features and security improvements, though they occasionally require some adjustment on our end. However, the benefits far outweigh this minor inconvenience, and we're excited to see how the platform evolves to balance innovation with user familiarity. We typically develop AWS serverless applications for many clients but lack in-house security engineers; that's where Escape proves invaluable. It also simplifies reporting to clients, and we intend to apply Escape security testing as a standard assessment in upcoming projects.

Escape brings a fantastic fresh approach to DAST testing, making it straightforward to manage intricate single-threaded scans. One of its most appreciated and often overlooked features is the screen capture within scan logs, enabling teams to quickly confirm whether authentication occurred and evaluate product coverage. Since Escape is a young company, there are some missing features, but they've mapped them out on their roadmap and iterate quickly based on user input—a rarity in a somewhat stagnant market. It tackles complex single-thread authentication scanning and brings simplicity to DAST scanning that no other vendor could offer us.

Escape is built with a deep understanding of various protocols and demonstrates a clear mastery of how they operate. The way it manages GraphQL operations is particularly impressive; my results have surpassed those from conventional DAST tools. The interface provides a high level of visibility into the scanning process and issue reporting, with superb filtering options that integrate seamlessly with any prioritization framework. Scans complete quickly. The tool comes equipped with all the essential integrations you need right away, covering the same ones you'd find with other DAST platforms. The team is also responsive to requests for new integrations when there's sufficient interest and it adds value. Support has been outstanding, with responses usually within half a day and effective assistance in troubleshooting. They're also open to joining calls to collaboratively debug and resolve issues. The AI Copilot is excellent on its own, but for further customization, Escape's MCP can be used with other AI tools to develop custom triage pipelines with your own context and knowledge. I've been using Escape since its early days, and pricing has always been fair. Now for some minor criticisms: Escape could significantly improve its UX and unify its offerings better. While it handles GraphQL schema files, there's no way to automate schema file updates; GitHub integration to automatically fetch and update schemas would be extremely helpful. Similarly, while Escape Copilot is skilled at reasoning with available data, that's not enough for me to fully trust its reasoning if the aim is to cut down triage time. Currently, I run custom pipelines using Escape's MCP for triage agents, leveraging my own code knowledge for correlation. If they added GitHub integration, they could use that to provide better triage outcomes. The UX around load times could also be improved; some pages and profiles take a while to display. Finally, Escape could enhance its APIs and other components with customer-side automation in mind. It generates good reports, but there's no automated method to export them as PDFs; you'd manually have to pull the data via API and format it, losing Escape's insights and presentation. I'm using Escape to fill gaps in our current DAST coverage as Sigma becomes more API-first and GraphQL-heavy. My previous tool struggled with GraphQL support, authenticated and logic-aware testing, and CI/CD integration, leading to weak coverage for issues like BOLA/IDOR and multi-step workflow flaws. Escape gives me better coverage on the surfaces that matter to me—GraphQL backends, APIs, and web apps—through native GraphQL discovery, authenticated and multi-user scanning, internal scanning via private locations, and more context-aware vulnerability detection. The practical advantage is broader coverage, higher-fidelity findings, and better operational fit. I anticipate fewer false positives, clearer signals for developers, and tighter integration with our workflows so security testing doesn't become a bottleneck.