StackHawk

Name: StackHawk
Brand: StackHawk
Rating: 4.6 (77 reviews)

Making it simple for developers to find, triage, and fix application security bugs.

Est 2019|Valuation $95M|Raised $50.2M|19 Ref Customers

LinkedIn 5K|Web traffic 11K|FTEs 28|HQ Denver, Colorado, US

MarketsApplication Security Testing (AST)Cloud-Native Application Protection Platform (CNAPP)

Published Oct 15, 2026

01Common complaints

1. An organization that needs traditional, compliance-oriented reporting as the primary outcome. Reported limitations in packaged reporting and PDF export capabilities suggest validation is required for audit-driven programs. 2. Applications requiring complex authentication where teams prefer GUI-driven, record-and-replay authentication setup. Review feedback indicates a code-oriented scripting approach that can be more demanding to implement than passive capture methods. 3. Very small engineering teams or early-stage startups with limited budgets. Per-contributor minimums on marketplace listings can make the offering less cost-effective compared to asset-based tools or startup-focused plans. 4. Programs where the primary need is continuous external attack-surface monitoring and discovery rather than CI/CD-integrated runtime testing.

Deal disqualifiers

Programs that require packaged, out-of-the-box compliance reports and executive-ready PDFs without custom work
Teams unwilling or unable to manage authentication scripting and configuration-as-code
Very small teams for whom contributor minimums make the offering uneconomical

Known limitations indicated by customers/reviews

Reporting and dashboard capabilities: customers have requested scorecards and exportable report formats.
Learning curve and setup complexity: particularly with authentication scripting and configuration-as-code approaches.

Roadmap / "not yet available" features

No public roadmap dates were captured in the materials reviewed. Buyers should discuss feature roadmaps with the vendor during evaluation.

Scale limitations

No documented hard limits (such as maximum endpoints or concurrency caps) were found in the reviewed materials; buyers should validate performance and scale characteristics with the vendor and through POC testing.

02Why they buy

Unique selling points supported by evidence in sources

CI/CD and PR workflow integration: The platform provides integrations and tooling for embedding scans into CI systems and issuing results into developer workflows.
Emphasis on modern API coverage: The vendor states support for REST, GraphQL, gRPC, SOAP, and WebSocket APIs; buyers should validate specific protocol coverage and detection capabilities during evaluation.

Where competitors may be stronger

Some competitors emphasize packaged executive reporting and governance workflows, which may align better to compliance-heavy programs.
Other vendors offer asset-based pricing and surface monitoring that can be more accessible to smaller teams.

03Field reports

The vendor references customer success stories for a large broadcaster, a prominent nonprofit platform, and a digital insurance/benefits provider. The public materials reviewed for this report did not include complete case study texts with independently verifiable, quantified metrics. Limitations: - ROI claims, time-to-value, and coverage improvements were not verifiable from the sources available in this research cycle. Conclusion: - Customer stories are used in vendor messaging to illustrate outcomes, but quantified results should be validated through direct references or POC metrics during evaluation.

Review platform snapshot

Review scores on commercial review platforms indicate positive reception in many accounts, with a moderate volume of reviews reflecting adoption across organizations of varying sizes.

Representative positive feedback

Reviewers cited scanning capabilities and integration into CI/CD pipelines as adoption drivers.
Some reviewers described the platform as fast and suitable for developer workflows, and noted that remediation guidance is clear.
Some reviewers reported the ability to configure authenticated scans using YAML configuration, which they found useful for their workflow.

Representative critical feedback

Reviewers noted limitations in reporting and dashboard capabilities, requesting scorecards and exportable report formats.
The configuration-as-code approach and authentication scripting were reported as having a learning curve; some reviewers indicated a preference for GUI-driven or passive capture-based approaches for authentication setup.

Common reasons cited for selection

Alignment with CI/CD workflows (GitHub Actions, PR feedback)
Configuration-as-code approach that enables automation
Faster scan execution compared to some legacy DAST tools (as reported by some customers)
Support for modern API types

Churn factors (inferred)

Organizations that require out-of-the-box, compliance-style reporting may find the platform less suitable without custom reporting work
Teams that prefer GUI-based setup or record-and-replay authentication flows may experience higher operational burden
Contributor-based pricing or minimums can make the platform less economical for small teams

04Best fit

Company size

The platform appears to be a plausible fit for mid-market and larger organizations with engineering organizations that operate multiple services and maintain CI/CD discipline. Very small teams may be disadvantaged if contributor minimums apply.

Industries

Commonly referenced industries include regulated or data-sensitive sectors such as healthcare and financial services; vendor marketing highlights these verticals but buyers should validate references during evaluation.

Roles and personas

Buyers: Heads of AppSec, security leadership, and engineering leadership
Users: AppSec engineers, DevSecOps teams, platform engineers, and service owners within development teams

Pain points addressed

Running runtime security tests earlier in the delivery pipeline
Integrating security feedback into developer workflows via PR and CI checks
Improving visibility into what is and is not being tested across services

05The pitch

What the product does (objective)

StackHawk is an application and API security testing platform oriented toward CI/CD-native Dynamic Application Security Testing (DAST) and broader application security intelligence capabilities. Its primary function is to enable engineering teams to identify exploitable runtime vulnerabilities earlier in the development lifecycle (pre-production) and to provide AppSec teams with visibility into testing coverage. Recent product messaging emphasizes three pillars: - Attack Surface Discovery (discover applications and APIs from source repositories) - Runtime Testing and Remediation (DAST designed to run inside CI/CD with configuration-as-code) - Oversight and Intelligence (dashboards and visibility to track coverage and risk posture) The vendor describes support for modern API types (REST, GraphQL, gRPC, SOAP, WebSocket) and developer workflow integrations.

Target market and positioning

StackHawk targets:

DevSecOps and teams applying a "shift-left" security approach
Teams that prefer developer-led security testing (pipeline/PR feedback loops) over periodic, centralized scans
Organizations with API-heavy architectures and rapid release cycles

Based on review platform snapshots and marketplace listings, StackHawk is commonly adopted in mid-market and enterprise contexts rather than very small teams.

Get a comprehensive analysis of StackHawk including market position, competitive landscape, adoption trends, and peer benchmarks.

Download full report →