# Agentless Surface Scanning at Scale and Modern Security Testing in CI/CD

**Escape Business Logic Aware DAST** (Dynamic Application Security Testing) is a feature that automatically tests APIs and Web Applications (including SPAs) for security weaknesses. By using **Escape ASM’s detailed output** (including automatically generated API Schemas from code or frontend assets), the Escape Business Logic Aware DAST engine works with the knowledge it needs to run meaningful **business logic security tests**. It can run at scale directly on all exposed APIs and Web Apps discovered by the ASM or as a configurable Modern Business Logic Aware DAST right in the CI/CD pipeline during the development phase.

This **Code-to-Cloud integration** means teams can test both production and development environments, internal and external assets, without manual traffic capture. Escape uses **reinforcement learning** to explore application behavior and test for **business logic issues**.

By combining **structured input (API Schemas)** with **intelligent test generation**, Escape Business Logic Aware DAST provides a clear, practical way to discover and address critical vulnerabilities **before they can be exploited**.

## Key Features

### Agentless and Traffic-Less Security Testing

Escape Business Logic Aware DAST uses the **API Schemas** from the ASM to understand how each endpoint should behave. It sends well-formed requests and tests the application as an **outside user would**, with agentless setup and no manual traffic capture.

### Modern Business Logic Aware DAST to Find Complex Business Logic Vulnerabilities in CI/CD

Escape Business Logic Aware DAST tests how the application handles its **data and processes**, including **multi-user access control**. It replays requests across user contexts to detect unauthorized access to another user's data. Run these tests during development, in CI/CD.

### Custom Security Rules

Default security tests are extensive and cover many vulnerabilities. However, for customers with **specific use cases**, Escape allows the creation of **custom rules**. These enable teams to build their own governance and apply it at scale, using custom rules.

### Sensitive Data Detection

During testing, Escape Business Logic Aware DAST detects **sensitive information exposure**, including **personal data (PII)**, secrets, and tokens that should remain private. The system uses both **static and dynamic analysis** to reduce false positives and highlight risks.

### Contextualized Results (Including Code Owners)

Escape Business Logic Aware DAST links every detected vulnerability back to the information gathered by **Escape ASM**. Each finding includes details like:

- Code owners
- Environment (production, staging)
- Exposure status
- Technology in use

This **extra context** makes it much easier to prioritize issues requiring urgent attention.

### Prioritization and Remediation

By knowing **who owns the code** and where the vulnerable component sits in the application stack, teams can quickly assign fixes to the right people. This reduces the time between detection and remediation.

### Internal Assets

Escape supports the deployment of a **Private Location** to detect, fingerprint, and test internal application assets behind firewalls or VPNs using a **reverse tunnel**.

### Issue Retest

On the next scan, Escape replays eligible findings on the profile that this run didn't already re-detect. To recheck specific issues without launching a full scan, use [Issue Retest](<https://docs.escape.tech/documentation/platform/issue-retest/index.md>). Same flow on AI Pentesting profiles.

## How it works

Escape Business Logic Aware DAST uses **machine learning** and **reinforcement learning**. It converts API definitions into a neutral model called a **MetaGraph**. This model guides test cases through the application's logic.

For more details, check out this article on **our Business Logic Security Testing algorithm**: [Escape Proprietary Algorithm](<https://escape.tech/blog/escape-proprietary-algorithm/>)

## Related Documentation

- [AI Pentesting](<https://docs.escape.tech/documentation/ai-pentesting/index.md>): AI-powered security testing capabilities for complex vulnerability discovery
- [Issue Retest](<https://docs.escape.tech/documentation/platform/issue-retest/index.md>): Automatic replay on the next scan, or recheck selected issues without a full run
- [File Upload Security Testing](<https://docs.escape.tech/documentation/dast/file-upload-security/index.md>): seven CWE / OWASP checks for multipart upload endpoints