Escape GTM brain

category

market profile

• text: Small security teams must cover a rapidly growing application and API attack surface while engineering ships frequently.
• text: The product brings attack surface management, dynamic application testing and AI pentesting into one continuous program.
• text: Security teams need actionable proof and remediation context rather than a large queue of unverified findings.

personas

• title: Head of application security
  pains:

  • A small security team cannot manually test every release
  • Legacy scanners miss business logic and create review work
• title: Offensive security or penetration testing lead
  pains:

  • Periodic manual assessments leave coverage gaps between tests
  • Evidence and retesting consume scarce specialist time
• title: Engineering security champion
  pains:

  • Security findings arrive outside the development workflow
  • Developers need reproducible context to prioritize fixes

icp

• text: Software companies with substantial web application and API estates and dedicated but capacity-constrained security teams.
• text: Organizations releasing frequently that need continuous testing and audit evidence across applications.
• text: Companies with modern GraphQL or other API-driven products are a natural fit for discovery and business logic testing.

message pillars

• text: Discover exposed assets across the stack.
• text: Test applications with business logic awareness.
• text: Keep pentesting aligned with release cadence.

objections

• objection: Our team already runs annual pentests and vulnerability scanners.
  response: Pilot continuous testing on a representative application and compare coverage and validated findings between release cycles.
• objection: Automated findings may create noise or disrupt production.
  response: Agree scope and testing safeguards with Escape, then review evidence and false positives in a controlled pilot.
• objection: AI usage could make costs unpredictable.
  response: The pricing page says the bill does not spike with scan volume; confirm contract terms and scope directly.

competitors

• name: Salt Security
  why: API discovery and security compete for API protection budgets.
• name: Aikido Security
  why: Developer-focused application security tooling overlaps with scanning and remediation workflows.
• name: YesWeHack
  why: Offensive security and penetration testing platform competes for testing budgets.

influencers

• name: Tristan Kalos
  url: https://escape.tech/blog/seed-fundraising-api-security/
  why: Co-founder and CEO who publicly explains Escape's security mission.

keywords

• API security testing
• continuous penetration testing
• business logic vulnerability scanner
• dynamic application security testing
• attack surface management
• GraphQL security testing
• AI pentesting

voice

• technical
• direct
• security practitioner oriented

signals

• text: Engineering teams ship frequently while application security headcount is constrained.
• text: An upcoming SOC 2 audit or penetration test creates demand for evidence and retesting.
• text: An expanding API footprint or exposed external assets makes inventory and testing harder.

stack

• AWS Marketplace

pricing

motion

channels

• SEO
• security research
• events
• podcast
• AWS Marketplace

confidence

Founders

• name: Tristan Kalos
  title: Founder
  role: Founder
  bio: Building Escape (YC W23) to help AppSec and Engineering teams secure their Single Page Apps, APIs, and Microservices. Previously ML engineer at source{d} and researcher at UC Berkeley. Passionate about solving complex business problems with creative technology or user experiences.
• name: Antoine Carossio
  title: Founder
  role: Founder
  bio: 🇫🇷 • Engineer • UC Berkeley • Apple