Skip to content

AI Pentesting FAQ

The questions teams ask most often when they evaluate AI Pentesting.

How Is Customer Context Handled?

Context stays inside your organization and is never used to train models.

Escape stores what it learns on the asset, not just on one scan. Fine-Tune context, authentication instructions, and artifacts live on the pentest profile. During a run, Cascade agents build a shared picture of the application: its auth model, workflows, and technology fingerprint. That knowledge is written back to the asset when the run ends.

Two things follow from that. The next assessment on the same asset reloads it instead of starting cold, so findings stay consistent between runs. And other Escape workflows on the same asset reuse it too, so a crawling map from an earlier run can seed later exploration.

Everything is scoped to your organization and asset. Other customers never see it.

See How It Works: AI Models and the AI Policy.

How Does Escape Validate Agent Findings?

Nothing is filed because an agent believes it found something. Worker agents explore and propose candidates, but they can't publish issues. A dedicated reporter re-runs each candidate against the live application, collects its own evidence, and files the issue only if it reproduces. Candidates that don't reproduce aren't confirmed findings.

See The Cascade Engine and Proof of Exploit.

How Is the Attack Chain Produced?

From what Cascade actually executed. Assessment events record HTTP traffic, browser actions, tool calls, and screenshots as the run progresses, and the attack path is assembled from those events. The reporter then reproduces the path on the live target before the issue is filed. Reasoning text explains those recorded steps, and Coverage shows which pages and APIs were reached.

See Proof of Exploit and Graph Reasoning.

Which Models Does AI Pentesting Use?

Cascade is a multi-model system. Escape routes work across its own models, running on Escape-controlled infrastructure, and frontier commercial APIs from OpenAI, Anthropic, and Google. No single provider powers the product end to end, because crawling, exploit design, validation, and evidence write-ups each reward different model strengths.

The routing, prompts, skills, and reporter loop are Escape IP. Customer data isn't used to train any of these models.

See How It Works: AI Models.

How Does Escape Keep Agents Inside Authorized Scope?

Outbound traffic goes through a scope-aware proxy that matches URL, host, HTTP method, and GraphQL operation against your allowlist and blocklist. Out-of-scope requests are blocked before they reach the target, whatever an agent tries to send. In-scope requests are the assessment itself, so exercising your application with security payloads is expected. Non-destructive rules still apply: agents don't drop data, delete accounts, or degrade availability.

See Scope and Guardrails.

Why Can Escape Agents Test When Consumer Chatbots Refuse?

Escape is an approved cybersecurity use case with its model providers. A consumer chatbot refuses because it can't verify who's asking or what they own. Escape can: assessments run as owner-authorized testing on assets you control, with scope verified by the platform before the run and beyond the reach of anything written in the context field. Calls go through Escape's own routing and system prompts, and the scope proxy, non-destructive rules, and reporter-only filing all still apply.

How Does Escape Handle AI Data Privacy and Compliance?

Escape maintains SOC 2 Type II certification. The Trust Center holds the report and related evidence, Privacy and Security covers data handling across the platform, and the AI Policy covers which models run where, training prohibitions, and retention. Zero-retention agreements are in place with commercial providers where available, and organization administrators can stop all AI Pentesting activity with the kill switch.

When Should I Use AI Pentesting vs DAST?

Use AI Pentesting for depth: multi-step attacks, business logic flaws, authorization issues, and findings backed by a reproducible attack chain. Use Business Logic Aware DAST for breadth: systematic repeatable coverage, fast checks in CI/CD, and custom rules.

Many teams run both, with DAST on a schedule or in the pipeline and AI Pentesting for deeper assessments of critical applications. See Positioning.