Escape Secures $18M to Automate Penetration Testing with AI

The recent $18 million Series A investment in Escape underscores a critical and growing market need: securing the vast number of applications now being built by non-developers using AI-powered platforms. This funding round, led by Balderton Capital with participation from Uncorrelated Ventures, IRIS, and Y Combinator, brings the company’s total capital to $23 million. The investment is a direct response to alarming research Escape published in late 2025, which scanned over 5,600 apps built on “vibe coding” tools like Lovable and Bolt.new. That study revealed a stark reality: thousands of high-impact vulnerabilities, exposed secrets, and unprotected personal data in live systems.

Escape was founded by French engineers Tristan Kalos and Antoine Carossio, who met at UC Berkeley. Their core insight was that traditional cybersecurity tools are fundamentally mismatched for today’s development pace. These older tools were designed for an era of slow, carefully reviewed code deployments, a model that has been completely upended by the rapid proliferation of AI-assisted and no-code development. Kalos points out that security teams are now massively outnumbered, struggling with manual processes while code is both written and attacked at the speed of AI.

The company’s approach is described as “offensive security engineering.” Instead of passively scanning code or waiting for bug reports, Escape’s platform uses AI agents to actively mimic hacker behavior against live, running applications. This method focuses on the production environment where true risks materialize, mapping attack surfaces, generating proof-of-exploit demonstrations, and then providing tailored fixes with clear reproduction steps for verification.

A key differentiator for Escape is this focus on live environments rather than static code repositories. Many critical security flaws only become apparent when an application’s full configuration, authentication flows, and business logic are operating in a real-world setting. By integrating directly into continuous integration and delivery (CI/CD) pipelines, the platform aims to catch vulnerabilities before they ever reach end-users, not after a breach occurs. This model has reportedly gained significant traction, with the company claiming over one hundred enterprise clients and consistent monthly revenue growth exceeding fifteen percent.

Suranga Chandratillake, the Balderton partner who led the investment, framed the deal as a wager on a fundamental industry shift. He argues that the old model of infrequent, manual penetration testing is obsolete. Security teams now face an impossible choice: use legacy automated scanners that lack depth or rely on manual testing teams that cannot possibly scale to match the volume of code being produced, especially by AI agents.

The new capital will fuel Escape’s expansion, aiming to double its current team of thirty-two over the next year and grow its enterprise sales operations in both the United States and Europe. Kalos notes the team already exhibits notable diversity for a security startup, thirty percent female with over twelve nationalities represented, and intends to preserve that culture during scaling.

This funding announcement coincides with a clear surge of investor interest in the AI security sector. On the same day, Paris-based Qevlar AI announced a $30 million raise for its own security operations platform. The simultaneous success of these two European startups is less a coincidence and more a market signal. Investors are increasingly convinced that the security gap created by AI-generated code is a substantial, persistent, and urgent problem demanding new solutions.

(Source: The Next Web)