Tool profile
StackHawk: cost, fit and limits
StackHawk is a dynamic application and API security testing product made by StackHawk, Inc. of Denver that scans running applications in CI and, through agent skills, lets AI coding agents find, fix and verify vulnerabilities before a pull request opens.
What to know first
StackHawk now leads with Wingman, a per-user plan at $10 a month with unlimited apps and 50 scans per user, and a quote-based Scale tier for larger programs. Its pages describe testing a running app and fixing issues in the same agent session. The product tests code that you own, so it does not map unknown production APIs. A 14-day trial needs no card.
StackHawk at a glance
| Maker | StackHawk, Inc., United States |
|---|---|
| Free plan | Free trial only |
| Entry price | $10 per user per month (Wingman) |
| API access | Yes |
| Category | Best AI API Security Software in 2026, rank 2 of 10 |
| Website | stackhawk.com |
Who StackHawk is best for
Teams that code with AI agents
Skills for Claude Code, Cursor, Codex, Antigravity and GitHub Copilot let an agent run a scan, edit the code and rescan before review.
Small engineering groups
A flat $10 per user a month with unlimited apps means cost follows headcount, not endpoint count, which suits startups with many small services.
Security teams that need evidence
The Wingman plan gives CI a clean signal and an attestation for security teams, which supports release approvals without a manual ticket.
StackHawk plans and pricing
| Plan | Price | What it includes |
|---|---|---|
| Wingman | $10 per user per month | Unlimited apps and 50 scans per user a month, agent auto-configuration, fix-and-rescan in one session, CI signal and attestation. Standard support. |
| Wingman trial | Free for 14 days | A 14-day trial with no credit card required to start. Covers the Wingman plan so a team can run real scans on its own repositories first. |
| Scale | Quote only | Unlimited apps and unlimited agentic scans, attack surface discovery, sensitive data detection, program reporting, teams and roles, SSO and enterprise support. |
Checked November 2026.
What StackHawk does
- Agent skills
- A HawkScan skill runs security tests against the running app after commits and before a pull request, and a StackHawk API skill lets the agent configure testing and triage findings.
- Exploitable-only findings
- The product page says runtime tests surface only issues that are actually exploitable, which keeps the finding count lower than a scanner that flags every possible weakness.
- Fix and verify loop
- The agent edits the codebase with full source context, then a rescan confirms the vulnerability is gone, giving a closed loop for each fix. Each fix is verified by the same tool that found it.
- Repository-wide skills
- Teams can place the skills in a repository so every developer gets the same security workflow instead of a personal setup. This keeps scan settings in version control.
- Program reporting on Scale
- Scale adds teams and roles, program reporting and attack surface discovery, aimed at security leaders who must report across many repositories. These extras are not available on Wingman.
How StackHawk handles your data
The security page says StackHawk runs on Amazon Web Services, encrypts sensitive customer data at rest with AES-256, uses TLS 1.2 or higher in transit and keeps administrative logs and daily database snapshots for at least 90 days. It reports an annual independent SOC 2 Type II audit, with the report and a yearly external pentest available on request, and says affected customers are notified within 72 hours. The page does not say how scan results are retained or deleted, and the policy mentions anonymized aggregate data.
Where StackHawk falls short in practice
- Needs a running app. StackHawk tests an application it can start, usually in CI. APIs that nobody documented or deployed through other routes remain invisible until Scale attack surface discovery is purchased.
- Scan cap per user. Wingman allows 50 scans per user a month. A team running scans on every commit may exceed that, and the page does not state overage terms.
- Scale pricing is unpublished. Only Wingman is priced. Companies that need SSO, roles or reporting must move to a quote, and the separate Scale trial is available on request from sales.
Works with
Alternatives to StackHawk
StackHawk: common questions
How much does StackHawk cost per developer?
The pricing page lists Wingman at $10 per user per month, with unlimited apps and 50 scans per user a month. Scale has no printed price. A team of twenty would pay about $200 a month on Wingman, before any negotiation or tax.
Does StackHawk have a free trial?
Yes. Wingman has a 14-day free trial that does not require a credit card to start. Scale has a separate 14-day trial that is available on request from sales, so plan a call if you need roles, SSO or program reporting during evaluation.
Which AI coding agents work with StackHawk?
The pricing and product pages name Claude Code, Cursor, GitHub Copilot, Codex and Antigravity. Skills can be placed in a repository so each developer uses the same workflow. Check that your agent version supports skills before you commit. Skills are optional for plain CI use.
Is StackHawk SOC 2 audited?
The security page states an independent SOC 2 Type II audit each year under the ISAE3402 standard, and that the report is available on request. It also states yearly penetration tests, with the external report available. Ask for both documents in your vendor review.
Can StackHawk find APIs we did not know about?
Not on Wingman. The product tests a running app you point it at. Scale lists attack surface discovery, which targets unknown assets, but the page gives few details. Ask for a demo against your own environment to see what it finds.