Escape

APIs have become the invisible infrastructure of the digital economy: they connect applications, move data, and orchestrate payments. They are also, increasingly, the preferred entry point for attackers looking to compromise a system. Traditional security struggles to keep pace because APIs change fast — new versions, new endpoints, new integrations — and manual testing cannot cover the full attack surface. Escape, a Paris-based cybersecurity startup, has built an offensive security platform designed specifically for this problem. Its system runs automated vulnerability scans against REST and GraphQL APIs, identifying configuration flaws, authentication issues, sensitive data exposures, and logical vulnerabilities that conventional scanners fail to catch. The platform integrates directly into CI/CD pipelines, meaning every new version of the code is tested automatically before it ever reaches production. This shift left — finding problems as early as possible in the development cycle — is precisely what modern security teams are looking for. Developers write code continuously; security engineers cannot manually review every deployment. Escape closes this gap by bringing API security into engineers' daily workflows without requiring additional specialized expertise. Over time, the platform has evolved toward a broader agentic approach: AI agents that not only detect vulnerabilities but actively guide the remediation process, suggesting fixes and verifying that patches are effective. The business model is B2B SaaS with subscriptions based on the number of monitored assets and the volume of tests executed; enterprise plans include custom integrations with DevSecOps systems and dedicated support. The market is driven by growing regulatory pressure — in Europe, the NIS2 directive and other frameworks impose stricter standards for application security — and by a mature awareness within engineering teams that security must be part of the process, not an afterthought.