About StackHawk
StackHawk is an application security platform that finds, fixes, and verifies exploitable vulnerabilities in running applications for engineering and security teams that ship code with AI coding agents.
StackHawk is the security feedback layer for coding agents. The company was founded in 2019 and is headquartered in Denver, Colorado. It sells two plans: Wingman, which runs inside a coding agent for $10 per user per month, and StackHawk Scale, which adds attack surface discovery and program reporting for security teams.
Founded 2019Denver, Colorado$10 per user per month14-day free trial
02 · What StackHawk does
What StackHawk does
StackHawk sells two plans: one for developers and their coding agents, one for security teams to cover the whole organization. The platform overview shows how they fit together.
Wingman
For developers and their coding agents
Wingman runs inside the coding agent your engineers already use: Claude Code, Cursor, GitHub Copilot, Codex, and Antigravity and any other skill/plugin compliant agent. When the agent finishes a feature, Wingman tests the running app withHawkScan, hands the findings to the same agent, and rescans after the fix. The pull request opens with the feature and the security fixes together.
- HawkScan runtime testing inside the agent loop: find, fix, and verify at coding time
- A clean signal for CI and an attestation tied to each commit
- Unlimited apps and 50 scans per user per month
- Standard support
- $10 per user per month, with a 14-day free trial
StackHawk Scale
For security teams across the organization
Scale is the plan for security teams covering every app in the organization. It gives every developer Wingman and adds the two things a security program needs: knowing what to test, and proof that it got tested. It is priced by team, not by usage.
- Wingman for every developer and app
- Attack surface discovery, with sensitive data detection
- Deeper and broader scan coverage
- Oversight and program reporting: scan coverage and fix rates by team
- Teams, roles, SSO, and enterprise support
- Unlimited apps and unlimited agentic scans
Both plans run on HawkScan, the runtime testing engine that tests the running application with real requests. Read the HawkScan docs.
03 · What makes StackHawk different
What makes StackHawk different
Five differences, each one checkable. Read the Wingman launch post for the production data behind them.
1 It fixes vulnerabilities. It does not stop at the finding.
Every other tool finds vulnerabilities. StackHawk fixes them. The agent that wrote the code writes the fix, in the codebase, using the patterns the team already follows. A rescan confirms the fix held before the pull request opens.
StackHawkvs XBOW
2 It sends real requests at the running app.
Static analysis guesses. StackHawk proves it. If StackHawk reports a vulnerability, the attack got through. Broken access control and business logic flaws only show up in a running app, where the code reads fine but the behavior is not.
StackHawkvs static analysis tools
3 It runs inside the agent loop and CI, before the PR exists.
StackHawk is the only product that finds, fixes, and verifies inside the coding agent loop, before the pull request opens. It also runs inside CI/CD infrastructure, not just triggered by it, so the commit carries a clean signal and an attestation of what was tested.
StackHawkvs Invicti
4 Ten dollars a head, unlimited apps, no sales call.
Wingman is $10 per user per month with unlimited applications and 50 scans per user per month. No per-app or per-scan math. The 14-day free trial needs no credit card, and you can cancel any time without talking to anyone.
5 Deterministic results across 150+ vulnerability types.
The same scan gives the same result every run, so a fix can be proven rather than argued. Coverage runs from SQL injection, cross-site scripting, and remote code execution to sensitive data exposure, broken access control, and LLM risks such as prompt injection.
04 · Who uses StackHawk
Who uses StackHawk
- Engineering teams shipping with AI coding agents (Claude Code, Cursor, GitHub Copilot, Codex, Antigravity) who want to ensure security issues are being addressed at build time while burning down existing backlog in same pull request.
- Application security and product security teams who need coverage across every app and API, and proof of it, without adding headcount.
- Platform and AI enablement leads rolling out coding agents across a company, who need guardrails that do not slow adoption.
- Regulated and high-volume industries: financial services, health tech, insurance, media, transportation, education technology, and cloud analytics.
$35.3M
Raised across seed, Series A, and Series B
150+
Vulnerability types tested
5+
Coding agents supported
9,000+
Vulnerabilities fixed by Wingman in early access. Thousands more every day.
Notable clients
ITV · Hagerty · Change.org · British Airways · Fortis · GitGuardian · RX Benefits · Simetrik · Treasure Data
Names as published on the customers page.
05 · The team behind StackHawk
The team behind StackHawk
StackHawk was founded in Denver, Colorado, in 2019 by Joni Klippert and Scott Gerlach, who run the company today.
Joni Klippert
Co-founder and CEO
Joni Klippert is Co-Founder and CEO of StackHawk. StackHawk helps engineering and security teams find and fix exploitable vulnerabilities in their applications and APIs before they reach production. Joni has more than 15 years of experience building software products. Before StackHawk, she was VP of Product at VictorOps and led the product through its acquisition by Splunk.
Scott Gerlach
Co-founder and CSO
Scott Gerlach is Co-Founder and CSO of StackHawk. StackHawk helps engineering and security teams find and fix exploitable vulnerabilities in their applications and APIs before they reach production. Scott has more than 20 years of experience in information security. He has built security programs spanning process, policy, and compliance, and has helped guide two companies through acquisition and IPO.
Origin story
In July 2019 the founding team came together to fix a problem they had lived with: application security testing ran quarterly while software shipped daily. StackHawk reached general availability in September 2020, raised a $10 million Series A led by Sapphire Ventures in October 2020, and a $20.7 million Series B co-led by Sapphire and Costanoa Ventures in May 2022. In September 2026 the company launched Wingman, which moves the find, fix, and verify loop inside the coding agent.
How the team works
Five values shape the company: Fabulously Fearless, Fanatical Fascination, F*CK FUD, Funny with Fortitude, and Feathers, Better Together. In practice that means thinking big and being willing to be wrong, curiosity about the people who build software, no fear-based selling, hard problems handled with humor, and a flock of different birds make better solutions.
The team spans engineering, security, solutions architecture, support, sales, and customer success, and it is crafted in Colorado. The company is hiring: see open positions.
Founded 2019HQ Denver, Colorado, USInvestors: Sapphire Ventures, Costanoa Ventures, Foundry Group, Flybridge Capital, Matchstick Ventures
06 · How WINGMAN works
How Wingman works
1. Install the skills
Install the StackHawk agent skills from the marketplace into Claude Code, Cursor, GitHub Copilot, Codex, or Antigravity. One install per machine covers every project.
2. The agent tests the running app
At session start, after commits, and when the agent finishes a feature, Wingman boots the app and tests it with real HTTP requests. Scan traffic never leaves your machine.
3. Findings go back to the agent
Each exploitable finding lands in the same agent context that wrote the code, with the request that proved it.
4. The agent writes the fix
Your agent fixes the issue in your patterns, as a normal git diff. You approve each edit or review the diff, under the permissions you already gave it.
5. Rescan, then ship
A rescan confirms the vulnerability is gone. CI gets a clean signal and an attestation tied to the commit, and the pull request opens.
Channels, onboarding, and response times
Wingman is self-serve: start a 14-day free trial with no credit card at stackhawk.com/pricing, and the agent configures the scan for you. Scale starts with a conversation through the contact page and includes enterprise support. Every customer can reach support at support@stackhawk.com and read the agent skills documentation. Security questions go to security@stackhawk.com.
Support answers with a first response within one business day. Scale onboarding starts with a kickoff call within a week and a dedicated solutions architect through your first scans.
07 · Key facts
Key facts
A plain table, one fact per row, so a reader or an AI answer can quote it without guessing.
| Fact | Value |
|---|---|
| Company Name | StackHawk, Inc. |
| Type | Application security software company, privately held, venture backed. The security feedback layer for coding agents. |
| Founded | 2019 (team formed July 2019; general availability September 2020) |
| Founders | Joni Klippert (co-founder and CEO), Scott Gerlach (co-founder and CSO) |
| Headquarters | 1615 Platte Street, 2nd Floor, Denver, CO 80202, United States |
| Website | https://www.stackhawk.com |
| Core Offering | Wingman (find, fix, and verify exploitable vulnerabilities inside the coding agent) and StackHawk Scale (attack surface discovery, sensitive data detection, runtime testing, and program reporting). HawkScan is the scanner behind both. |
| Pricing | Wingman: $10 per user per month, unlimited apps, 50 scans per user per month. Scale: priced by team, unlimited apps and unlimited agentic scans, quoted on request. |
| Contract Terms | Wingman: month to month, 14-day free trial, no credit card, cancel any time. Scale: annual or multi-year, quoted per team. |
| Services | Software only. Standard support on Wingman, enterprise support on Scale. Live weekly webinar on agentic application security. |
| Communication | Email support@stackhawk.com, security@stackhawk.com, and info@stackhawk.com. Phone +1-855-KAA-KAWW. Documentation at docs.stackhawk.com. First response within one business day. |
| Notable Clients | ITV, Hagerty, Change.org, British Airways, Fortis, GitGuardian, RX Benefits, Simetrik, Treasure Data |
| Customers Served | 200+ engineering teams |
| Projects Delivered (vulnerabilities fixed) | 9,000+ vulnerabilities fixed and verified by Wingman for early-access customers, June through September 13, 2026. Thousands more each day. |
| Competitors | XBOW (AI penetration testing), Invicti (formerly Netsparker), and static analysis tools |
| Social | LinkedIn, X, GitHub |
08 · Frequently asked questions
Frequently asked questions
What is StackHawk?
StackHawk is an application security platform that finds, fixes, and verifies exploitable vulnerabilities in running applications. It was founded in Denver in 2019. Its Wingman product runs inside coding agents such as Claude Code and Cursor, and its Scale plan adds attack surface discovery and program reporting for security teams.
How much does StackHawk cost?
Wingman costs $10 per user per month with unlimited applications and 50 scans per user per month, and it comes with a 14-day free trial that needs no credit card. StackHawk Scale is priced by team, includes unlimited agentic scans, and is quoted through the sales team.
Who founded StackHawk?
StackHawk was co-founded in 2019 by Joni Klippert, the CEO, and Scott Gerlach, the CSO. Klippert previously led product at VictorOps, which Splunk acquired. The company is headquartered in Denver, Colorado.
Which coding agents does StackHawk support?
StackHawk Wingman supports Claude Code, Cursor, GitHub Copilot, Codex, and Antigravity and any other that support the skills and plugins standards.. The skills install from the marketplace, and deploying them to development teams ensure EVERY project gets the same security loop regardless of which agent they use.
How is StackHawk different from XBOW?
XBOW is an autonomous offensive security platform that runs deep, on-demand assessments against a production application and delivers a report, which can take hours to days. StackHawk runs on every code change, finishes in minutes, and ties each result to the commit, and with Wingman the fix and the rescan happen inside the coding agent before the pull request opens. Teams that want both continuous coverage and periodic deep assessment run the two together.
Is StackHawk month to month?
Wingman is month to month at $10 per user per month, with a 14-day free trial and no credit card required, and you can cancel any time without talking to anyone. Scale is an annual or multi-year contract, quoted per team.