Release Notes¶

#174 · Custom session login in AI Pentesting: paste your cookie, headers, localstorage, we handle the rest

Getting past custom authentication is where most automated testing stops short. Sometimes a hardcoded value is the only way through. Now it's one line of text.

You can now hand the Escape's AI Pentesting agent a session directly. Paste your cookie, headers, or local storage values into the authentication instructions as plain text, and the agent starts the run already authenticated.

What's new

In the user authentication instructions, write your session details as plain text. For example:

Use the session cookie session=abc123 for https://app.customer.com. It's already valid, no need to log in.

Escape extracts the cookie, along with any request headers or local storage values you include, and injects them into the agent's browser before the run starts. The agent lands already authenticated.

This works per user, so each role you configure in the scan setup flow can carry its own session. Available in both AI Pentesting and pentest target validation, so behavior is consistent across the product. Describing a login flow still works and stays the default.

Why it matters

• Works for the hard cases: SSO, MFA, custom tracing header. Sometimes a hardcoded value is required to bypass things.
• No setup overhead. It's the existing instructions field, in plain text. No new form, no config, no onboarding change.

Security & safety

This handles live credentials, so we were deliberate:

• Extracted secrets are not sent to asset or reporting events. Session values don't appear in logs or reports.
• A dedicated extractor model parses only what you explicitly write. It never invents credentials.

#173 · ASM Technology Detection: Map Every Asset to Known CVEs

Availability: General Availability

Escape ASM fingerprints the software on each asset: packages, frameworks, and infrastructure components, with versions when the stack exposes them. You get a live technology inventory across web apps, APIs, and connected repositories, matched to known CVEs so you trace a vulnerable dependency to every asset that runs it. Known CVEs matched to a detected package version.

What's new:

• Multi-source fingerprinting: HTTP response analysis, source maps, stack traces, protocol-level signals, and repository manifest parsing identify packages and deployed software without installing agents on your infrastructure.
• Packages and software: libraries from npm, PyPI, and other ecosystems sit alongside web servers, CMS platforms, and reverse proxies, each linked back to the parent asset.
• Version-aware CVE matching: versioned technologies match against affected ranges at high confidence; versionless detections still map through standard product identifiers at adjusted confidence.
• Actionable findings: matches become Vulnerable Dependency Detected issues with severity, affected versions, fix version when available, and advisory links.

Technology Detection documentation →

CVE Scanning documentation →

Questions?

Have a question? Reach out on your dedicated support channel, or email us at support@escape.tech.

#172 · ASM Port Scanning: Map Every Open Service on Your Attack Surface

Availability: General Availability

Every ASM host scan probes over 1,400 commonly observed TCP ports and feeds what it finds straight into your inventory. You see open ports on each host, the services behind them, and security issues before you dig into API endpoint mapping. Teams closing shadow IT gaps told us they need internet-facing port exposure visible up front, not buried behind extra clicks.

Open ports and detected protocols on a monitored DNS host.

What's new:

• Broad TCP coverage: when ASM scans a DNS, IPv4, or IPv6 host, Escape probes the default port set across web services, databases, remote access, message brokers, and more. Set port_scanning.ports in Global Configuration to replace that default list:

port_scanning:
  ports:
    - 80
    - 443
    - 8080
    - 8443

• Service fingerprinting: confirmed open ports get protocol and technology fingerprinting, then land on the host asset before downstream discovery runs.
• Discovery pipeline: open ports feed service discovery that maps REST, GraphQL, gRPC, SOAP, web apps, and OpenAPI candidates.
• Insecure protocol detection: cleartext services like FTP and Telnet raise insecure_technology_used findings with remediation guidance.
• Default credential checks: active probes against detected services (FTP, Telnet, MongoDB, Redis, and others) raise default_credentials_used when authentication succeeds.
• Exposure guardrails: the unusually_high_open_ports check flags hosts that expose more open ports than your threshold through a public Escape proxy (default: 5).

Network Scanning documentation →

Questions?

Have a question? Reach out on your dedicated support channel, or email us at support@escape.tech.

#171 · ASM Login and CAPTCHA Detection: See Auth Friction on Every Web App

Availability: General Availability

Every ASM web app scan now fingerprints the login surface before you touch scan profiles. You get the login requirement, login page URL, registration path, SSO providers, auth protocol, auth technology, and CAPTCHA provider on each asset. AppSec teams told us they need this context upfront: which apps gate sign-in with MFA or CAPTCHA, and where SSO redirects land, before they configure authenticated DAST or plan allowlists.

What's new:

• Login page discovery: an agent browses each web app and records whether login is mandatory, optional, or absent, plus the login page URL and detected SSO providers.

• Auth fingerprinting: HTTP probing and redirect analysis classify auth protocol and technology (OAuth, OIDC, Auth0, Cognito, and similar) on web apps, REST APIs, and GraphQL APIs.

• CAPTCHA provider detection: dual fingerprinting via HTTP technology signatures and browser rendering flags reCAPTCHA, hCaptcha, Cloudflare Turnstile, and other providers on each frontend.

  

• Filters: filter web apps by CAPTCHA provider and review login and auth fields from the asset side panel.

Asset Management documentation →

Questions?

Have a question? Reach out on your dedicated support channel, or email us at support@escape.tech.

#170 · Consistent Issue Finding: DAST and AI Pentesting Share One Security Story

Availability: General Availability

Most automated pentests or DAST treat your application like a stranger: point, scan, report, start over. Escape AI Pentesting and DAST do not start from zero. They store the previously found vulnerabilities in their context, and make sure to test them out during the next engagements. Every run compounds context instead of rediscovering the app, giving you less overhead and consistent issue finding across executions.

What's new:

• Prior findings in every engagement: Previously found vulnerabilities stay in context on the asset. DAST and AI Pentesting pull them into the next run and actively retest them, so open issues stay validated instead of vanishing between scans.
• Less execution overhead: You compound context run to run instead of re-triaging the same weakness or wondering whether last week's finding still holds.

AI Pentesting documentation →

Introducing Cascade on the Escape blog →

Questions?

Have a question? Reach out on your dedicated support channel, or email us at support@escape.tech.

#169 · AI Pentesting Deferred Start: Schedule Assessments for the Right Window

Availability: General Availability

You set when an AI Pentesting assessment starts instead of launching the moment you confirm the profile. Pick a future date and time from the create or edit flow, save a validated configuration, and Escape starts the run on your schedule. That fits release windows and off-hours test beds.

What's new:

• Deferred start on create and edit: Choose "Schedule for later" and set date and time in your local timezone, or save a reviewed configuration as draft and queue the run for later. Escape holds the profile until the clock hits.
• Scheduled profile card: Open a profile with a queued run and you see when the next assessment starts, with a shortcut to edit the schedule.

Set the deferred start from the Schedule tab on profile create or edit.

The profile shows the queued run and links straight to edit the schedule.

AI Pentesting documentation →

Questions?

Have a question? Reach out on your dedicated support channel, or email us at support@escape.tech.

#168 · Introducing Cascade: Penetration Testing That Becomes an Expert in Your Business

Availability: General Availability

Cascade is Escape's multi-agent AI pentest engine. It starts every engagement with what the platform already knows about your attack surface: APIs, web apps, schemas, tech stack, and scope from ASM and DAST. You're not pointing a stranger at a URL. You're running an assessment that compounds context across releases and gets sharper about how your business actually works.

Cascade starts from ASM context, coordinates a multi-agent swarm, and ships every finding with proof.

What's new:

• Multi-agent swarm: An orchestrator plans the engagement and spawns focused exploitation agents on demand. A coverage agent closes gaps. A reporter independently reproduces every candidate before it's filed.
• Proof of exploit: Every finding ships with the attack chain, request sequence, screenshots where relevant, and framework-specific remediation. Unproven candidates don't pollute your queue.
• Auditable scope: Discovery maps your full configured scope before exploitation. You see exactly which endpoints, pages, and assets were assessed.

AI Pentesting documentation →\ Introducing Cascade on the Escape blog →

Questions?

Have a question? Reach out on your dedicated support channel, or email us at support@escape.tech.

#167 · Jira Integration: Custom Fields, Two-Way Status Sync, and Workflow Ticketing

Availability: General Availability

Run triage where your team already works: map Escape findings into the Jira fields your process depends on, keep ticket and finding status aligned when work closes on either side, and open issues from workflows with the right project, filters, and field values filled in automatically.

What's new:

• Custom field mapping: map any Escape property to any Jira field, including custom fields specific to your schema.
• Two-way status sync: resolving a finding in Escape closes the Jira ticket, and vice versa. A manual "Close in Jira" action is available from the issue view too.
• Workflow-based ticketing: create tickets straight from workflows. Filter by severity or saved view, route to the right project, and populate fields automatically.

Questions?

Have a question? Reach out on your dedicated support channel, or email us at support@escape.tech.

#166 · Smarter Tables: Saved Views, Grouping, and Column Control

Availability: General Availability

Your tables now remember you. Name a view, pick your columns, set your filters, group by what matters to your team. Come back tomorrow and it's all exactly where you left it. Wire any view into a workflow trigger and your automation runs on the same scope your team sees every day.

What's new:

• Saved views: name your setup and own it. Filters, columns, grouping, chart selection, and sort order: all saved. Set a default that loads when you open the page. Pre-built views for Web Applications, API Services, Hosts, and more come included.
• Advanced filtering: build exactly the query you mean: AND, OR, nested groups. Like "(Project A OR Project B) AND Status = Monitored". Charts always reflect the active filter state.
• Column control: show what's relevant, hide what isn't. Each view has its own column set, so your "Web Applications" and "API Services" views look exactly right for what they are.
• Grouping: group by project, tag, asset type, or source, with multi-level grouping. Each group shows aggregated counts; expand it to see what's inside.
• Workflow integration: views wire directly into workflow triggers. Your automation runs on the exact slice of your attack surface your team already works with.

Questions?

Have a question? Reach out on your dedicated support channel, or email us at support@escape.tech.

#165 · New Report Template: Executive Summary and Redesigned Issue Layout

Availability: General Availability

Your security report now serves the full room. A new executive summary gives leadership a clear read on your security posture and the actions worth prioritizing. A redesigned issue layout makes findings faster to triage for the engineers doing the work.

What's new:

• Executive summary: a dedicated section that distills your security posture into clear signals: risk level, trend, and the top actions worth taking, sharable to leadership without writing a separate briefing.
• Redesigned issue layout: findings are structured for triage, with evidence, severity, and remediation steps in a consistent, scannable format so you spend less time parsing and more time fixing.

Report and export documentation →

Questions?

Have a question? Reach out on your dedicated support channel, or email us at support@escape.tech.