Skip to content

AI Pentesting FAQ

The questions teams ask most often when they evaluate AI Pentesting.

How Is Customer Context Handled?

Context stays inside your organization and is never used to train models.

Escape stores application knowledge on the asset for use across assessments. Fine-Tune context, authentication instructions, and artifacts live on the pentest profile. During a run, Cascade agents build a shared picture of the application: its auth model, workflows, and technology fingerprint. That knowledge is written back to the asset when the run ends.

Two things follow from that. The next assessment on the same asset reloads it instead of starting cold, so findings stay consistent between runs. And other Escape workflows on the same asset reuse it too, so a crawling map from an earlier run can seed later exploration.

Everything is scoped to your organization and asset. Other customers never see it.

See How It Works: AI Models and the AI Policy.

How Does Escape Validate Agent Findings?

Worker agents explore and propose candidates. A dedicated reporter independently re-runs each candidate against the live application and collects its own evidence. Successful reproduction is required before the reporter files a confirmed finding.

See The Cascade Engine and Proof of Exploit.

How Is the Attack Chain Produced?

From what Cascade actually executed. Assessment events record HTTP traffic, browser actions, tool calls, and screenshots as the run progresses, and the attack path is assembled from those events. The reporter then reproduces the path on the live target before the issue is filed. Reasoning text explains those recorded steps, and Coverage shows which pages and APIs were reached.

See Proof of Exploit and Graph Reasoning.

Which Models Does AI Pentesting Use?

You don't need to select a model to run AI Pentesting. Configure scope, authentication, context, and duration in your profile.

The routing, prompts, skills, and reporter loop are Escape IP. Customer data isn't used to train any of these models.

See How It Works: AI Models.

How Does Escape Keep Agents Inside Authorized Scope?

Outbound traffic goes through a scope-aware proxy that matches URL, host, HTTP method, and GraphQL operation against your allowlist and blocklist. Out-of-scope requests are blocked before they reach the target, whatever an agent tries to send. In-scope requests are the assessment itself, so exercising your application with security payloads is expected. Agents are instructed not to drop data, delete accounts, or degrade availability. Keep the default scope restrictions unless you've reviewed the affected operations.

See Scope and Guardrails.

Why Can Escape Agents Test When Consumer Chatbots Refuse?

Escape is an approved cybersecurity use case with its model providers. A consumer chatbot refuses because it can't verify who's asking or what they own. Escape can: assessments run as owner-authorized testing on assets you control, with scope verified by the platform before the run and beyond the reach of anything written in the context field. Calls go through Escape's own routing and system prompts, and the scope proxy, non-destructive rules, and reporter-only filing all still apply.

How Does Escape Handle AI Data Privacy and Compliance?

Escape maintains SOC 2 Type II certification. The Trust Center holds the report and related evidence, Privacy and Security covers data handling across the platform, and the AI Policy covers which models run where, training prohibitions, and retention. Zero-retention agreements are in place with commercial providers where available, and organization administrators can stop all AI Pentesting activity with the kill switch.

How Does AI Pentesting Test AI and LLM Features?

In the same assessment as the rest of the application. Cascade looks for:

  • Prompt injection. The model follows an instruction that overrides its task, including one hidden in a document, page, or retrieved chunk.
  • Sensitive disclosure. The response contains hidden instructions, another user's data, or a secret.
  • Insecure output handling. The application renders or executes model output.
  • Tool abuse. The assistant calls a tool with arguments the caller shouldn't control.
  • APIs behind MCP. Cascade tests the APIs those tools call, alongside the rest of the application.
  • Cross-tenant retrieval. Retrieved content belongs to another tenant, or attacker-controlled content is acted on.

When Should I Use AI Pentesting vs DAST?

Use AI Pentesting for depth: multi-step attacks, business logic flaws, authorization issues, and findings backed by a reproducible attack chain. Use Business Logic Aware DAST for breadth: systematic repeatable coverage, fast checks in CI/CD, and custom rules.

Many teams run both, with DAST on a schedule or in the pipeline and AI Pentesting for deeper assessments of critical applications. See Positioning.