Tristan Kalos and the lesson in the empty database

The database was empty. Tristan Kalos had gone looking for the reason a client’s application had stopped working, and found a ransom demand instead. Ten bitcoins would supposedly bring the data back. A software developer expects the occasional broken feature. This was a rather more expensive form of feedback.

He had built the application. He could make it work. Protecting it had proved a different skill. When he retells the episode, he puts himself inside the failure: he had discovered a gap in his own knowledge. That admission is the beginning of Escape, the cybersecurity company he would later co-found with Antoine Carossio.

Today, Kalos is Escape’s co-founder and CEO, based in New York. His work takes in product, sales and marketing, an expansive job description for someone whose public author biography ends with the modest sentence, “I was a dev before.” That earlier identity helps explain the company he has built. He knows what it feels like to deliver software and then discover how much remains to be learned.

An artist in the computer club

Before the security business came the business of making computers useful to other students. At ENSTA Paris, Kalos was a founding member of the DaTA computing club. His activities included shared course tools, hosting student projects and teaching introductory computing. These were practical services for people who had assignments to finish, rather than an abstract audience waiting to admire a technology.

The club’s 2016 roster records him as vice-president. Its affectionate description calls him an artist, with his long hair offered as supporting evidence. Student societies have a useful resistance to executive polish. Years before a company biography would describe his research background, his friends had settled on a more entertaining credential.

He also helped build the website and online registration system for a student music festival at Université Paris-Saclay. Alongside the programming came event preparation and practical organizing. The work put software in contact with ordinary inconveniences: registering, communicating, finding something that another person needed. It is an early, concrete example of building for a community he belonged to.

His subsequent path included research at the University of California, Berkeley and machine learning engineering at source{d}. He graduated from ENSTA in 2019 and also took the X-HEC Entrepreneurs master’s. He credited ENSTA with teaching him how scientific research could produce things in the real world. The interesting destination was something people could use.

The first customer was his old school

Kalos and Carossio came together through their entrepreneurship studies, with Berkeley part of their shared founding story. Kalos brought the experience of building applications and confronting a breach. Carossio brought a background in security and work at Apple. Each wanted to start a company. Their skills gave them a reason to start the same one.

In a conversation about Escape’s beginnings, Carossio volunteered a clarification: “I was not the person who hacked Tristan.” It is a welcome correction to a story that otherwise risks making their partnership sound almost suspiciously convenient. The pair could laugh about the incident while taking its lesson seriously.

Escape was founded in 2020. That November, it was one of three startups awarded the Jean-Louis Gerondeau - Safran prize, with each receiving €20,000. The early plan was to help developers protect cloud applications without giving up productivity. The prototype used a minimal digital twin to simulate attacks while limiting the information required for testing.

ENSTA Paris was the first customer, testing that prototype under real conditions. The school had supplied part of Kalos’s technical education; now it was supplying a place to see whether his company’s ideas worked. The founders said the prize money would help them recruit an R&D intern and continue development. An intern and a working prototype make a pleasantly tangible starting point for a company that would later raise millions.

Small tools, useful introductions

An API is one of the ways software asks other software for information or actions. For a developer, getting the right response is part of the job. For a security engineer, the questions extend further: who is asking, what should they be allowed to see, and what happens when requests arrive in an unexpected order? Kalos’s work sits in that territory between an application functioning and its behavior being safe.

In October 2021, he began a practical security guide for developers. Its starting complaint was the shortage of cybersecurity resources aimed at the people writing applications. The exercises used a deliberately vulnerable Python web application and GitHub Actions. Readers could work through security checks inside a development process instead of treating the subject as a separate discipline with a separate entrance exam.

The same preference for practical help appeared in Graphman, which he introduced in August 2022. Escape’s team had found writing GraphQL queries by hand tedious when using Postman. They made a free, open-source utility that generated a Postman collection from a GraphQL endpoint. It addressed a specific annoyance that the team had experienced itself.

The conversation beneath the announcement is revealing. A reader asked about broader support for other tools. Kalos replied that compatibility already existed through Postman collections and acknowledged the issue the reader had opened. There is no grand theory of community in that exchange. Someone asks for a useful improvement, and a maintainer answers.

In 2023 he also introduced Goctopus, an open-source tool for discovering and identifying GraphQL endpoints. Its capabilities included finding subdomains, detecting authentication and examining schemas. Discovery addressed an elementary problem: a security team needs to know what is exposed before it can decide what to test. The software helped turn that question into something a developer could investigate.

“I build, hack and sell things.”

TRISTAN KALOS / GITHUB BIOGRAPHY

The engineers had something to write

Escape’s early marketing followed a related instinct. Kalos described trying email and in-person networking, then finding that technical articles shared in developer communities brought people to the company. Reddit, DEV Community and Hacker News gave the team places to meet readers already interested in the problems they were solving.

The writing became part of the engineering routine. Every three weeks, the team set aside a day for engineers to write about what they had built. Those sessions produced articles that could be published over the following weeks and shared with relevant communities. A developer explaining a recent piece of work had something specific to offer a reader.

That arrangement also gave Escape a public record of its thinking. Kalos’s own posts range from hands-on development tools to arguments about application testing. A reader can move from a small utility to a broader technical position and see the questions change. The writing contains the everyday work behind the company’s pitch.

By 2023, he and Carossio were presenting their GraphQL security research at conferences. Their Nordic APIs Platform Summit session explored findings from scanning more than 2,000 endpoints. Kalos also appeared on the GraphQLConf program. The tools, articles and talks supplied several ways into the same conversation: developers could try something, read an explanation or question the people who built it.

When the flaw is in the rules

In March 2024, Kalos argued for a different approach to finding business logic flaws. These are problems bound up with how an application is supposed to behave: permissions, workflows and relationships between users and data. His concern was that familiar scanning approaches could miss failures specific to a business. Finding recognizable patterns in code left part of the problem unresolved.

Consider the general question of access: an application may return a perfectly valid response while giving one user information intended for another. Understanding that failure requires context about the users and the rules. The application’s intended behavior matters to his technical argument: a test needs to establish whether the response follows the rules as well as whether it works.

The emphasis connects his engineering background with his commercial role. Selling a security product involves explaining a technical failure in terms that another team can act on. His author biography places product, sales and marketing together. The writing offers a view of that work: explaining why a test should examine the way a company operates, then giving engineers a way to run it.

In April 2024, Kalos announced that he and Carossio had been included in Forbes’s 30 Under 30 list. His public response credited Escape’s team and its work, with recognition followed by a return to the job. By then, the student programmer and the founder had accumulated quite different credentials. The practical problem running through his work remained recognizable.

A larger company, the same unfinished job

Escape joined Y Combinator’s Winter 2023 batch. In March 2026, it announced an $18 million Series A led by Balderton, with Uncorrelated Ventures and existing investors IRIS and Y Combinator participating. The funding backed a broader offensive security platform covering attack surface discovery, application testing and AI penetration testing.

Kalos’s stated ambition was to deepen the platform’s ability to reason about application logic and cover attacks involving several steps. The company also planned to grow engineering, research and commercial teams across the United States and Europe. His customer had once found an application unusable; the present work concerns how teams keep checking software as it changes.

He has continued explaining that problem publicly. In a CyberBytes conversation, he described AI as accelerating the production of code while also giving attackers more capability. His argument concerned how defenders organize and use the technology available to both sides. The challenge, in his telling, lies in giving security teams enough capacity to keep up.

On October 15, 2026, he published a guide to penetration testing requirements across compliance frameworks. The subject is less picturesque than a ransom message, but it belongs to the same working life: helping people connect technical testing with decisions inside an organization. Customers need evidence they can use, as well as a warning that something is wrong.

The most persuasive detail in Kalos’s story remains the original admission. He had known how to build an application and learned, abruptly, that he needed help protecting it. Around that experience he assembled a partnership, a company, tools and a substantial amount of explanation. The empty database gave him a question. Much of his career since has been spent making the answer useful to somebody else.