StackHawk’s Wingman fixes security flaws while the AI agent is still coding

Security firm StackHawk Inc. unveiled Wingman, a solution that detects security flaws while an AI is still writing the code. The software integrates into agentic coding platforms like Claude Code, Cursor, and GitHub Copilot. Once a feature is marked as complete, Wingman automatically scans, runs the application as an attacker would, and reports any issues back to the original coder.

The coder can then make the necessary fixes, which are re-scanned before being submitted for pull requests. StackHawk believes that Wingman's strength lies in its ability to understand the application's architecture, dependencies, and coding conventions, unlike scanners that are added later. The tool supports Codex and Antigravity as well.

Every commit is monitored, giving security teams a clear record of what was released. Wingman has already fixed over 7,000 vulnerabilities for early-access customers, with 98% of those repairs lasting. StackHawk's CEO, Joni Klippert, noted that attackers often discover vulnerabilities before they're publicly known, and AI coding tools have accelerated the pace of development beyond what traditional security teams can handle.

"Finding the issue was never the hard part," Klippert said, "it's fixing and verifying it fast enough to keep up with how quickly engineering teams are shipping code today." The tool is available for $10 per user per month, with unlimited applications and 50 scans per user monthly. A 14-day free trial is also offered. Teams interested in broader API discovery and attack-surface mapping can use StackHawk Scale, the company's enterprise version.

StackHawk serves over 200 enterprises and has raised $20.7 million in venture capital, led by Sapphire Ventures and Costanoa Ventures. Klippert emphasized in a March interview with theCUBE that developers don't need to become security experts to create safe code.