Enhancing API Security: Escape's Dynamic Scanning Approach for Uncovering Vulnerabilities

 

Escape, a beautiful French startup, has successfully raised a significant funding round of $3.9 million (€3.6 million) shortly after completing Y Combinator's winter 2023 cohort. The company specializes in providing a cybersecurity product that focuses on securing APIs before their public release.

The funding round is led by French venture capital firm Iris, with participation from Frst. Existing investors such as Irregular Expressions, Tiny Supercomputers, and Kima Ventures are also participating. Notable angel investors include Philippe Langlois, Mehdi Medjaoui, and Roxanne Varza.

Co-founder and CEO Tristan Kalos explained that Escape has developed a custom algorithm powered by artificial intelligence. This algorithm simulates cyber attacks to identify security flaws in APIs, offering remediation solutions. Tristan Kalos founded Escape with Antoine Carossio, and the team has grown to include 10 members.

Escape's solution is agentless, seamlessly integrating into the development pipeline. Whenever the development team commits new lines of code to the repository, Escape is triggered through an integration in the continuous integration/continuous delivery flow (CI/CD).

One of Escape's key capabilities is identifying issues such as rate limiting, which, if exploited, could lead to the extraction of large volumes of data by malicious actors. Additionally, Escape verifies if invalid actions are effectively blocked to prevent data manipulation. The platform integrates with Snyk, ensuring that Escape's identified issues appear in the code issues of Snyk.

Tristan Kalos explained that Escape conducts dynamic tests, examining the running application rather than the source code itself. APIs pose a unique challenge due to the complexity of their business logic and interaction methods. To address this, Escape employs reinforcement learning, a combination of deep learning and heuristics.

Initially, Escape focused on GraphQL APIs as its go-to-market strategy. However, the company is now expanding its support to REST APIs, which are more prevalent than GraphQL-based APIs.

Escape has already secured approximately 20 clients, including notable companies like Sorare, Shine, and Neo4J. The startup aims to target larger clients operating in sensitive industries, including banks and financial services companies. Each contract with these clients has the potential to be worth tens of thousands of euros annually.

Prior to Escape, ensuring the security of company APIs relied mostly on manual processes. Large companies would occasionally collaborate with security analysts for penetration tests (pentests). However, these tests were infrequent and reactive, with security reports being delivered once or twice a year. The companies would then review the findings and internally assign tasks to resolve the identified issues, often leading to delays and an imperfect process.

Escape does not seek to replace pentests entirely since they cover a broader scope than just APIs. Instead, Escape's objective is to identify and address security flaws at the API level as soon as they emerge. By taking a proactive and dynamic approach, Escape ensures that most issues are resolved before a security firm conducts a pentest. This innovative security model offers a more compelling and marketable proposition for clients.