Sold by: Escape
Discover and validate exposure of modern apps, APIs, and AI services across your entire distributed engineering org in real time. From code to cloud.
4.9
Overview
Image
Asset discovery and inventory
Image
Shadow API discovery
Image
Automations and workflows
Legacy EASM finds hosts and ports. Your engineers ship APIs, SPAs, MCPs, and AI apps.
Escape Attack Surface Management maps your actual application layer. Every REST API, GraphQL endpoint, SPA, MCP, gRPC and SOAP service your engineers are shipping across your distributed org. If it's exposed, Escape finds it. Including the ones nobody filed a ticket for.
What you get with Escape ASM
-
Application-layer discovery, not just hosts and ports. Customers find 30% more attack surface on average from shadow APIs alone. The endpoint that shipped without a ticket, the staging service nobody took down, the MCP a developer prototyped and forgot. Agentless scanning plus native connectors map your full attack surface in under an hour.
-
Findings that route themselves to owners. Every asset is mapped to the team that built it, pulled from your repos. No more "who owns this?" Slack threads. Findings reach the right engineer with the asset context already attached. Security engineers save roughly 12 hours per month on triage and routing.
-
Proof of exploitability, not just inventory. There's a difference between a vulnerability that exists and one that can actually be exploited. Every asset comes with a code fix and a proof-of-exploit trace - the request sequence that demonstrates the issue is real and reachable. Engineers trust what was found and ship the fix.
-
Scales with your org, including M&A. Public API, CLI, custom reporting, programmable workflows. New acquisition, new product line, new team, every new asset is discovered, attributed, scanned, prioritized, and routed without anyone filing a ticket.
-
Multiplies your existing stack. Every discovered asset flows into Wiz with full application-layer context: owner, type, exposure level, associated risk. Your risk platform gets smarter. Manual asset hygiene drops.
Highlights
- Application-layer discovery, not ports and hosts Map every REST API, GraphQL endpoint, SPA, MCP, gRPC, and SOAP service your engineers are shipping. Find 30% more attack surface from shadow APIs alone.
- From asset to action in one hour. Agentless scans and native code-repo connectors map your full API attack surface in under an hour. Every asset routed to the team that built it, with proof of exploit attached.
- Built to scale with M&A and distributed orgs. Programmable via public API and CLI. New acquisitions, product lines, and teams onboarded automatically. Every asset flows into Wiz with full application-layer context.
Details
New
Introducing multi-product solutions
You can now purchase comprehensive solutions tailored to use cases and industries.
Features and programs
Trust Center
Access real-time vendor security and compliance information through their Trust Center powered by Drata or Vanta. Review certifications and security standards before purchase.
Financing for AWS Marketplace purchases
AWS Marketplace now accepts line of credit payments through the PNC Vendor Finance program. This program is available to select AWS customers in the US, excluding NV, NC, ND, TN, & VT.
Pricing
Pricing is based on the duration and terms of your contract with the vendor. This entitles you to a specified quantity of use for the contract duration. If you choose not to renew or replace your contract before it ends, access to these entitlements will expire.
Additional AWS infrastructure costs may apply. Use the AWS Pricing Calculator to estimate your infrastructure costs.
Dimension | Description | Cost/12 months |
|---|---|---|
Attack Surface Management: 250 assets, annual | AWS Marketplace offer. Continuous discovery and monitoring of up to 250 application-layer assets (REST APIs, GraphQL endpoints, SPAs, MCPs, gRPC and SOAP services, AI apps). Includes agentless discovery, code-owner mapping, proof-of-exploit, RBAC, integrations (Wiz, Jira, Slack), public API and CLI. For all other scenarios, request private offer instead. | $12,000.00 |
Dimensions summary
This listing offers one pricing option billed as an annual contract. You pay for coverage of up to 250 application-layer assets, such as REST APIs, GraphQL endpoints, single-page apps, and AI apps. Pricing is fixed to this asset count for a 12-month term. All included capabilities—agentless discovery, code-owner mapping, proof-of-exploit, role-based access control, integrations, and API and CLI access—come with this single tier. If your needs fall outside 250 assets, you request a private offer instead of buying this standard package.
Top-of-mind questions for buyers
An asset is a single application-layer resource that the platform discovers and monitors. This includes each REST API, GraphQL endpoint, single-page app, MCP, gRPC service, SOAP service, or AI app. Every discovered endpoint counts as one toward your 250-asset total.
This standard package covers up to 250 assets for the annual term. If your discovered assets exceed that count, this listing does not automatically scale. You request a private offer instead to arrange coverage that fits a different asset volume.
The single package includes agentless discovery, code-owner mapping, and proof-of-exploit traces. You also get role-based access control, integrations with common security and workflow tools, plus public API and command-line access. All these capabilities apply to your covered assets for the 12-month term.
escape.tech
Helpful?
Vendor refund policy
Refunds are not generally provided for AWS Marketplace contract purchases. For billing disputes or service issues, contact support@escape.tech within 30 days of subscription start.
Legal
Vendor terms and conditions
Upon subscribing to this product, you must acknowledge and agree to the terms and conditions outlined in the vendor's End User License Agreement (EULA) .
Content disclaimer
Vendors are responsible for their product descriptions and other product content. AWS does not warrant that vendors' product descriptions or other product content are accurate, complete, reliable, current, or error-free.
Delivery details
Software as a Service (SaaS)
SaaS delivers cloud-based software applications directly to customers over the internet. You can access these applications through a subscription model. You will pay recurring monthly usage fees through your AWS bill, while AWS handles deployment and infrastructure management, ensuring scalability, reliability, and seamless integration with other AWS services.
Resources
Support
Vendor support
Escape support is included with every subscription, you can always reach us at support@escape.tech . Customers get a dedicated Slack channel with the security engineering team, a named CSM for production deployments, and 24/5 support across business hours.
AWS infrastructure support
AWS Support is a one-on-one, fast-response support channel that is staffed 24x7x365 with experienced and technical support engineers. The service helps customers of all sizes and technical abilities to successfully utilize the products and features provided by Amazon Web Services.
Similar products
Thanks to evolving technologies, hackers, and other cyber criminals it has become easier than ever to find and exploit weaknesses in your organization’s defenses.
AI-powered DAST that easily integrates with your modern stack, finds even the most complex issues, and helps developers with remediation.
Designed from the ground up by Escape Technology, Sherpa is a simple-to-use cloud-resource management tool ideally suited to creative teams looking to leverage the power of AWS. Sherpa provides a unified, user-friendly platform that empowers businesses to maximize the potential of their AWS cloud investments while minimizing operational overhead.
Run continuous, AI-powered pentesting assessments with exploitability proof and reporting auditors and your engineers will both actually act on.
Realize savings on your on-premise VMware deployment and transform your infrastructure at the same time at little to no cost. IO Connect Services evaluates your entire VMware implementation, its associated licensing, and infrastructure to develop your VMware to cloud migration, modernization, and transformation readiness roadmap. As an AWS Advanced Technology Partner, skilled in migration, integration and transformation IO Connect will perform a VMware Specific Migration Readiness (MRA), solidified in AWS best practices, delivering financial and technological recommendations in under two weeks for potential in-year savings upwards of 43%.
Customer reviews
Varun S.
Fast, Transparent DAST with Excellent GraphQL Handling and Strong Support
Reviewed on Jun 18, 2026
Review provided by G2
What do you like best about the product?
Escape is built with a wide range of protocols in mind and shows a strong understanding of how they work. In particular, I really liked how it handles GraphQL operations. I’ve gotten better results than with traditional DASTs.
The UI/UX offers a lot of transparency into what the tool is doing and how it reports issues. Filtering is excellent, and it’s easy to adapt it to whatever prioritization matrix you use. Scans are also quick.
Escape comes with the baseline integrations you need from day one. It covers the same integrations you’d expect from other DAST platforms, and the team is quick to work with you on new ones when there’s enough interest and it improves the overall experience.
Support has been consistently strong: they typically respond within half a day and do a great job helping resolve issues. They’re also willing to jump on calls to debug and fix things together.
Escape's AI Copilot is great on its own, but if you want to extend it further, you can use Escape MCP with other AI tools to build your own triage pipelines with custom context and knowledge.
I was an early adopter of Escape, and their pricing has been fair since day one.
The UI/UX offers a lot of transparency into what the tool is doing and how it reports issues. Filtering is excellent, and it’s easy to adapt it to whatever prioritization matrix you use. Scans are also quick.
Escape comes with the baseline integrations you need from day one. It covers the same integrations you’d expect from other DAST platforms, and the team is quick to work with you on new ones when there’s enough interest and it improves the overall experience.
Support has been consistently strong: they typically respond within half a day and do a great job helping resolve issues. They’re also willing to jump on calls to debug and fix things together.
Escape's AI Copilot is great on its own, but if you want to extend it further, you can use Escape MCP with other AI tools to build your own triage pipelines with custom context and knowledge.
I was an early adopter of Escape, and their pricing has been fair since day one.
What do you dislike about the product?
I’m mostly going to nitpick here.
Escape could elevate the UX tremendously and connect its offerings more cohesively. It supports GraphQL schema files, but there’s no way to automate schema file updates. It would be a huge help if it had GitHub integration so it could automatically discover and pull schema files.
Similarly, Escape Copilot is great at reasoning with the information that’s available, but that alone isn’t enough for me to fully trust its reasoning when the goal is to reduce triage time.
Right now, I run custom pipelines via Escape’s MCP for triage agents, using my own code knowledge for correlation. If they introduce GitHub integration, they could leverage it to provide better triage outcomes.
They could also improve the UX around load times. The platform takes a while to load pages and profiles.
Lastly, Escape could improve their APIs & other component with customer side automations in mind. Escape generate good reports but there is no automated way to export those as PDFs. You have to manually fetch the data via API and format it where the escape insights and presentation is lost.
Escape could elevate the UX tremendously and connect its offerings more cohesively. It supports GraphQL schema files, but there’s no way to automate schema file updates. It would be a huge help if it had GitHub integration so it could automatically discover and pull schema files.
Similarly, Escape Copilot is great at reasoning with the information that’s available, but that alone isn’t enough for me to fully trust its reasoning when the goal is to reduce triage time.
Right now, I run custom pipelines via Escape’s MCP for triage agents, using my own code knowledge for correlation. If they introduce GitHub integration, they could leverage it to provide better triage outcomes.
They could also improve the UX around load times. The platform takes a while to load pages and profiles.
Lastly, Escape could improve their APIs & other component with customer side automations in mind. Escape generate good reports but there is no automated way to export those as PDFs. You have to manually fetch the data via API and format it where the escape insights and presentation is lost.
What problems is the product solving and how is that benefiting you?
I’m using Escape to close the gaps in our current DAST coverage as Sigma becomes more API-first and GraphQL-heavy. Previous tool was falling short for me on GraphQL support, authenticated and logic-aware testing, and CI/CD integration, which meant weaker coverage for issues like BOLA/IDOR and multi-step workflow flaws.
Escape helps me by giving me better coverage across the surfaces I actually care about - our GraphQL backends, APIs, and web apps - with native GraphQL discovery, authenticated and multi-user scanning, internal scanning through private locations, and more context-aware vulnerability detection.
The practical benefit to me is that I can get broader coverage, higher-fidelity findings, and better operational fit. I’m expecting fewer false positives, better signal for developers, and tighter integration with our existing workflows so security testing is less of a bottleneck.
Escape helps me by giving me better coverage across the surfaces I actually care about - our GraphQL backends, APIs, and web apps - with native GraphQL discovery, authenticated and multi-user scanning, internal scanning through private locations, and more context-aware vulnerability detection.
The practical benefit to me is that I can get broader coverage, higher-fidelity findings, and better operational fit. I’m expecting fewer false positives, better signal for developers, and tighter integration with our existing workflows so security testing is less of a bottleneck.
Information Technology and Services
Excellent DAST disruptor
Reviewed on Sep 11, 2025
Review provided by G2
What do you like best about the product?
Escape has an excellent modern approach to DAST testing making it easy to manage complex single threaded scans. One of the nicest/underated features is the screen capturing in scan logs allowing teams to quickly validate if authentication has occured and to assess product coverage.
What do you dislike about the product?
Since it is a start up there are some features missing but they have added them to the roadmap and quickly iterate through version based on user feedback a rarity in a stagnant market.
What problems is the product solving and how is that benefiting you?
It solves complex single thread authentication scanning and creates simplicity to DAST scanning which no other vendor was able to provide for us.
Financial Services
API security : inventory & security checks made easy!
Reviewed on Feb 19, 2025
Review provided by G2
What do you like best about the product?
Easy to setup
Easy to integrate to your CI/CD
Public and private internal APIs supported
Nice advices and examples for your developers to address issues
Capacity to create workflows
Easy to integrate to your CI/CD
Public and private internal APIs supported
Nice advices and examples for your developers to address issues
Capacity to create workflows
What do you dislike about the product?
Small company, which could block the purchasing process in some large companies.
Not yet recognized company even if their product is great
Not yet recognized company even if their product is great
What problems is the product solving and how is that benefiting you?
Help identifying vulnerabilities or coding errors continually in our APIs and propose solutions to our developpers.
Nobuyuki I.
Best API security testing tool in the world!
Reviewed on Feb 17, 2025
Review provided by G2
What do you like best about the product?
We have been using Escape platform for a couple years since the beginning of their product.
It effectively addresses the pain points in API security management!
The tool excels in detecting a wide range of API vulnerabilities, including business logic flaws often missed by other solutions.
It effectively addresses the pain points in API security management!
The tool excels in detecting a wide range of API vulnerabilities, including business logic flaws often missed by other solutions.
What do you dislike about the product?
The updates to the platform, while ensuring we always have access to the latest features and security enhancements, can sometimes require a bit of adjustment on our part.
Nevertheless, the benefits of the tool far outweigh this minor inconvenience, and we look forward to seeing how the platform evolves to balance innovation with user familiarity.
Nevertheless, the benefits of the tool far outweigh this minor inconvenience, and we look forward to seeing how the platform evolves to balance innovation with user familiarity.
What problems is the product solving and how is that benefiting you?
We usually build AWS serverless applications for many clients, but we do not have experienced security engineers in our team that's where Escape platform helps us a lot.
Reporting to the client becomes much easier as well, we want to apply Escape security testing to upcoming projects as a standard security assesments
Reporting to the client becomes much easier as well, we want to apply Escape security testing to upcoming projects as a standard security assesments
Information Technology and Services
API Security with Escape
Reviewed on Jan 30, 2025
Review provided by G2
What do you like best about the product?
Easy to integrate. Helped to quickly check and make sure our GraphQL endpoints were secure.
Great customer support as well.
Great customer support as well.
What do you dislike about the product?
No complaints here. Worked great for us.
What problems is the product solving and how is that benefiting you?
It is helping us make sure our API security is up to date.