Skip to content

AI Network Pentesting

AI Network Pentesting attacks your IPs, IP ranges, and domains the way an attacker would: from the internet, or from inside your network through a private location. You get the exposed services, weak configurations, and credential weaknesses that are actually reachable, each reproduced with evidence, in one assessment.

Beta

AI Network Pentesting is a separate product in beta and may change. Contact your Escape representative to enable it for your organization.

Summary tab of a finished AI Network Pentesting assessment: 22 findings across 15 assets, split by severity, next to the Assets Overview A finished assessment's Summary tab: findings by severity and the assets the run reached.

How It Works

  1. You define the scope. Paste IPv4 addresses, IPv4 CIDR ranges, IPv6 addresses, and domains, or import a CSV.
  2. You pick the attack vectors. Each vector is labeled Safe (it only observes) or Intrusive (it can disturb the target). Agents plan their attacks within your selection.
  3. Escape validates the scope. Validate Configuration checks every target from the selected location before anything is attacked.
  4. Escape maps the network. It resolves DNS records, scans TCP ports on every host and range, and fingerprints the services behind open ports.
  5. Cascade attacks. Cascade, the same multi-agent engine behind AI Pentesting, runs reconnaissance on every open port, then sends agents after each weakness your attack vectors allow.
  6. Every finding is reproduced. A reporter agent re-runs each candidate against the live target and attaches its own proof before an issue is filed.

You follow every step live in the Reasoning tab, and read the results in Issues and Assets. See Results.

What It Tests

AI Network Pentesting covers the network and service layer of your infrastructure:

  • Exposed services: databases, remote administration interfaces, debug endpoints, and industrial protocols such as Modbus listening on the internet.
  • Credentials: default passwords on services that authenticate, plus weak credentials and authentication bypass when you allow them.
  • TLS: legacy protocols (SSLv3, TLS 1.0 and 1.1), weak ciphers, small keys, and expired, self-signed, or mismatched certificates.
  • DNS: zone transfers, open resolvers, and unauthenticated dynamic updates.
  • Known vulnerabilities: CVEs matching each service version, exploited with public proofs of concept when you allow it.

The full list, with what each vector does and doesn't do, is on Attack Vectors.

AI Network Pentesting, AI Pentesting, and ASM

You want to Use
Find which services an attacker reaches on your IPs and domains, with proof AI Network Pentesting
Test a web app or API in depth: authentication, access control, business logic AI Pentesting
Keep a continuous inventory of your exposed assets ASM

AI Network Pentesting doesn't sign in to your applications and doesn't test the business logic behind them. Run an AI Pentesting assessment on the web apps and APIs it finds.

Beta Limits

  • No Active Directory testing. Escape tests the hosts and services in scope, not your directory.
  • No asset discovery. Escape tests the scope you enter. It doesn't enumerate subdomains or pull assets from integrations yet.
  • IPv4 ranges only. IPv6 addresses are accepted one by one. IPv6 ranges aren't.
  • Range size. Ranges up to /24 (256 addresses). Wider ranges are available on request.

See Scope for every input rule.

Documentation

  • Quickstart: create a profile and run your first assessment
  • Scope: accepted targets, limits, and port coverage
  • Attack Vectors: what each vector tests, safe and intrusive
  • Guardrails: rate limit, duration, kill switch, and allowlisting
  • Results: assessment tabs, issues, and proof
  • FAQ: common questions about scope, safety, and coverage