StackHawk is an application security company that tests running applications and APIs for exploitable vulnerabilities. Its current focus is code written by AI coding agents: StackHawk plugs into the agent’s working loop so that security flaws are found, fixed and verified before a pull request is opened.
It serves two audiences: developers who want feedback on their own code before review, and AppSec teams who need to know which applications and APIs exist across the organisation and how well each is tested.
At A Glance
| Vendor | StackHawk, Inc. |
|---|---|
| Category | Application and API security testing (DAST) |
| Deployment | SaaS platform; HawkScan runs via Docker or the Hawk CLI |
| Agentic AI | Wingman and agent skills for coding agents |
| Customers | Hagerty, ITV, Change.org, Breathe Life, British Airways |
| Market classification | Application Security |
What StackHawk Does
Static scanners tend to report long lists of possible issues. StackHawk tests the running application instead and reports only what is actually exploitable, “No noise.”
The work follows a Find, Fix, Verify loop. Runtime tests find the exploitable issue, the coding agent writes the fix in the codebase with full source context, and a rescan confirms the vulnerability is gone. The same runtime tests run in CI/CD pipelines and on pull requests, where they can break a build, so problems surface earlier in delivery.
Products
Wingman
Developers who let coding agents build features need a way to check that generated code is safe before it ships. Wingman scans the running app the agent has just built, passes each finding back to the agent and rescans to prove the fix worked. It installs on each developer’s machine rather than per repository, and scans are triggered at session start, after commits and when the agent finishes responding.
Agent Skills
For teams that want security testing inside their existing agent workflow, StackHawk publishes skills the agent can call directly:
| HawkScan skill | Runs security tests against a running app after a commit and before the pull request, covering issues such as SQL injection, IDOR and broken authentication |
|---|---|
| StackHawk API skill | Lets the agent configure testing and triage findings on the platform |
| Repository installation | Installing at repository level gives every developer on a team the same security workflow |
Platform Modules
AppSec teams responsible for a whole portfolio use the platform modules to see what exists and how well it is tested.
| Visibility | Discovers every app and API from source code, ties them to risk insights and generates OpenAPI specifications |
|---|---|
| Testing | Runtime AppSec testing that is deterministic and reproducible, with consistent results across scans |
| Oversight | Programme-level views of risk, test coverage and prioritisation |
How It Works
HawkScan runs close to the application and reports to the hosted platform.
| Component | What it does |
|---|---|
| HawkScan | The scanner runs from a Docker container or the Hawk CLI, on a laptop, a server, Kubernetes or inside a delivery pipeline. |
| Configuration | A YAML file named stackhawk.yml, usually in the project root, sets the application ID, environment and target host. |
| Platform | HawkScan streams results to the platform as it runs, so scan status can be followed online in real time. It authenticates with an API key. |
| Test environments | Because HawkScan may create, update and delete data while testing, it should only be pointed at environments where that is acceptable. |
Agentic AI Capabilities
Coding Agent Support
The skills have no dependencies and work with Claude Code, Codex, Cursor, GitHub Copilot and Google Antigravity. Wingman’s plugin uses a hook that starts a scan only when one is warranted, and the skills try to work out how the application handles authentication so that tests can reach protected routes.
Testing AI Applications
Beyond code written by agents, StackHawk covers testing of remote MCP servers and LLM applications, alongside GraphQL and gRPC APIs, so teams building their own AI services can test the endpoints those services expose.
Company Background
| CEO | Joni Klippert, co-founder |
|---|---|
| CSO | Scott Gerlach, co-founder |
| Location | Colorado, United States |
Note: This overview is compiled from StackHawk’s publicly available information as of 3 November 2026. It is provided for information only. NHI Mgmt Group does not endorse any vendor, and nothing on this page represents the opinions of NHI Mgmt Group.