Ray Breslin is a former prosecutor who co-owns Breslin-Clark, a Los Angeles–based security firm specializing in testing the reliability of maximum security prisons. He spends his life getting into prisons to study their designs and the guards' habits to find and exploit their weaknesses, thus enabling him to escape without a hitch. He claims his goal is to ensure that criminals sent to prison stay there. One day, he and his business partner Lester Clark are offered a multimillion dollar deal by CIA agent Jessica Miller to test a top-secret prison and see if it is escape-proof. Breslin goes against all his own rules and chooses the money. He agrees to the deal and gets himself captured in New Orleans, Louisiana, under the guise of a Spanish terrorist named "Anthony Portos", but the plan goes awry when his captors remove the tracking microchip from his arm and drug him on the way to the prison.
Breslin wakes up in a complex of glass cells with no outside windows to indicate the prison's location. He meets fellow inmate Emil Rottmayer, and they both stage a fight for Breslin to study the solitary confinement cell, which uses high-powered halogen lights to disorient and dehydrate prisoners. Seeing that the cell floors are made of aluminum, but the rivets are steel, Breslin has Rottmayer procure a metal plate from Warden Willard Hobbes's office floor before the both of them and Muslim inmate Javed are once again thrown into solitary. Using the metal plate, Breslin focuses the reflection from the lights to heat the rivets and pop open the floor panel to reveal a passageway below. He goes through the passageway and discovers that the prison is inside a cargo ship in the middle of the ocean, making a simple escape impossible. Breslin and Rottmayer continue to study the complex by learning the guards' daily routines, and Breslin gives Hobbes false information about Rottmayer's boss, Victor Mannheim. Meanwhile, Breslin's colleagues Abigail Ross and Hush grow suspicious of Clark when Breslin's paycheck for the job is frozen. They discover from hacked documents that the prison, codenamed "The Tomb", is owned by a for-profit organization linked to an unnamed privately owned security provider, and Clark was offered a US$5 million annual salary from them in exchange for keeping Breslin behind bars.
Back in the prison, Hobbes reveals to Breslin that he is aware of his identity, and with chief security officer Drake watching him, he wants to ensure that Breslin stays for the rest of his life. Rottmayer has Javed convince Hobbes to bring him on deck to do his nightly prayer when he actually uses a makeshift sextant to get the ship's latitude. Using the latitude and observations of the weather, Breslin and Rottmayer deduce that they are in the Atlantic Ocean near Morocco. Breslin visits the infirmary of Dr. Kyrie and convinces him to help him and Rottmayer escape by sending an email to Mannheim. Breslin then transmits a false tap code message from his cell, giving Hobbes the impression that a riot will occur in cell block C. With majority of the security stationed at cell block C, Javed instigates a riot at cell block A, giving him, Breslin, and Rottmayer time to run toward the deck while a lockdown is initiated. Breslin kills Drake, but Javed is shot dead by Hobbes and his men during their escape. Breslin goes to the engine room to reboot the electrical systems, giving Rottmayer time to open the deck hatch while a helicopter sent by Mannheim engages in a gunfight with the ship's crew. Rottmayer boards the helicopter while Breslin is flushed to the bottom of the ship by the automated water system. The helicopter picks up Breslin, but when Hobbes starts shooting at them, Breslin kills the warden by shooting a group of oil barrels in front of him. They land on a beach in Morocco, where Rottmayer reveals that he is actually Mannheim, Miller is his daughter, "Portos" was a codeword used to alert Mannheim that Breslin was an ally, and Rottmayer was originally unaware that Breslin's cover story was fake. Later, at a Moroccan airfield, Ross informs Breslin that Clark had fled, but Hush tracked him in Miami, Florida, and locked him in a container aboard a cargo ship.