Escaped defect
An escaped defect is a bug that was present in a release when it shipped, passed through every test stage undetected, and was found in production by a user, by support or by monitoring. The word escaped locates the gap in the process rather than in the code: the defect existed before release, and the checks built to catch it did not.
The longer version
Every release carries defects out the door; the question a team can act on is which stage should have caught each one. An escaped defect is traced backwards. It was in the code at the time of the release build, so some test could have exercised it. The unit tests did not cover the path, or the integration environment lacked the data that triggers it, or the test case existed but was skipped under time pressure, or nobody wrote a case because the requirement never mentioned the situation. Naming the stage that missed it is what makes an escape useful; counting it alone is not.
An escape is not the same as a regression, though one bug can be both. A regression is a defect in behaviour that used to work, introduced by a later change. An escape is any defect, new or regressed, that reached production untested. A brand new feature that ships with a broken edge case is an escape and not a regression; a regression caught in staging is a regression and not an escape. The neighbouring measure is defect removal efficiency, which compares the defects caught before release with the escapes found after it.
Treating the count as a score for QA teaches testers to argue that a production bug was a configuration problem or a user error rather than an escape, and the number stops meaning anything. Fixing the bug without tracing the escape leaves the same gap in coverage to leak a similar defect next release. The useful ritual is short: for each escape, name the stage that should have caught it and add the test or the data that would have. Escapes reported by users also arrive with less evidence than a tester's report, which is why reproducing one takes longer.
Common questions
What is the difference between an escaped defect and a regression?
A regression is a defect in something that previously worked, caused by a later change. An escaped defect is any defect that reached production without being caught, whether it regressed old behaviour or shipped with a new feature. A regression caught before release is not an escape; a new feature's bug found by a user is an escape but not a regression.
How do you measure escaped defects?
Tag every defect at intake with where it was found: a test stage or production. Escapes are the ones tagged production and confirmed to have existed at release time, rather than caused by an environment change afterwards. Read them per release and by the stage that should have caught each one, since the stage is what a team can change.
Is every production bug an escaped defect?
A production bug is an escape only if it was in the release when it shipped. A bug caused by a later infrastructure change, an expired certificate or a third-party API changing its response is a production defect but not an escape, because no pre-release test could have caught it. The distinction matters because escapes point at the test process and the others point at operations.
Who is responsible for an escaped defect?
The process, and the team that runs it, rather than any one tester. An escape means a test stage let the defect through, so the useful question is which stage and why: a missing case, absent test data, a skipped run. The team owns the analysis, the owner of that stage owns the correction, and blaming an individual teaches everyone to argue that the next production bug was not an escape.
Can escaped defects be prevented entirely?
Every release carries some defects out, because no test process exercises every path under every combination of data, browser and timing that production supplies. The goal is to make each escape rarer in kind: an escape traced to a missing test closes that gap for good, while one that is only fixed leaves the gap open. A team that reports zero escapes has usually stopped counting them.
Bug reports that arrive ready to triage.
Collect replay, console, network and browser context with the Free plan.