CISO Tribune

Vendor comparison · 2 companies

Data Theorem vs StackHawk

Data Theorem sells application security products that secure code, mobile apps, APIs and cloud. StackHawk sells two plans, Wingman and StackHawk Scale, that run on HawkScan, a runtime testing engine for running applications. CISO Tribune files both under API security. This page sets the two records side by side: what each sells, where it is based, who owns and funds it, the customers it names and its recent news, each fact numbered to its source.

Change the companies

Up to four companies side by side.

  • Data Theorem
  • StackHawk
Data Theorem vs StackHawk: Products, Customers and Funding Compared
Data TheoremData Theorem sells application security products that secure code, mobile apps, APIs and cloud.datatheorem.comStackHawkStackHawk sells two plans, Wingman and StackHawk Scale, that run on HawkScan, a runtime testing engine for running applications.stackhawk.com
What it sells
  • Mobile Secure[2][6][8]Automated security and privacy testing for every iOS and Android release.
  • Mobile Protect[2][3][7][13]Mobile Protect defends the app on the device.
  • Code SAST Secure[3][5][8][14][16]SAST, SCA and SBOM across every repo, in more than 20 languages.
  • API Secure[2][5][8][13][15]API Secure discovers every REST, GraphQL, gRPC, SOAP and serverless API.
  • Cloud Secure[2][5][8][16]Cloud Secure extends API Secure into the cloud your APIs and apps run on.
  • Wingman[15][16]Runs inside a coding agent and tests the running app.
  • StackHawk Scale[15][16]The plan for security teams covering every app in the organization.
  • HawkScan[3][15]The runtime testing engine that tests the running application with real requests.
Categories
Headquarters
Palo Alto, United States[1]Not stated on its pages
Founded
Not stated on its pagesNot stated on its pages
Ownership and funding
Not stated on its pagesNot stated on its pages
Named customers
Not stated on its pagesNot stated on its pages
Recent news
  • June 30, 2026Data Theorem launched three AI security capabilities that together form a closed-loop platform covering exploit discovery, remediation, and runtime defense.[17]
  • April 30, 2026StackHawk connected its scan findings to Wiz, where they are synced automatically and shown as enrichment data on the Attack Surface Findings page.[12]
  • December 16, 2025StackHawk launched Business Logic Testing, automated multi-user authorization testing aimed at BOLA, BFLA and privilege escalation vulnerabilities.[14]
  • November 20, 2025StackHawk announced an integration that correlates findings from Endor Labs' SAST with StackHawk DAST findings.[13]
G2 and Gartner Peer Insights
  • G2: listed, seen November 3, 2026[10]
  • Gartner Peer Insights: Not stated on its pages
  • G2: Not stated on its pages
  • Gartner Peer Insights: Not stated on its pages
Who it fits
From its own pages, the company sells to teams that need to find every app, API and cloud resource, including the ones nobody told security about. It addresses teams that want to catch issues in code and the pipeline and hand auditors reports built from real scans. Game publishers are addressed with Mobile Protect for Gaming, which stops cheats, tampering and clones in the game.Application security and product security teams that need coverage across every app and API are named as buyers, and the Scale plan is for security teams covering every app in the organization. The industries named are financial services, health tech, insurance, media, transportation, education technology, and cloud analytics. Scans are described as fitting into any pipeline and any environment, with no vendor cloud.
Last verified
September 27, 2026November 2, 2026

Where they overlap

  • Data Theorem and StackHawk are both filed under API security.

Where they differ, field by field

  • Data Theorem's primary category is API security; StackHawk's is Dynamic application security testing.
  • Data Theorem is also filed under Static application security testing, Mobile security and Cloud-native application protection (CNAPP).
  • Data Theorem lists Mobile Secure, Mobile Protect, Code SAST Secure, API Secure and Cloud Secure. StackHawk lists Wingman, StackHawk Scale and HawkScan.
  • Data Theorem is headquartered in Palo Alto, United States.

What it sells: Data Theorem

What Mobile Secure does[2][6][8]
Mobile Secure provides automated security and privacy testing for every iOS and Android release. Mobile Secure signs in to your apps and tests every screen of every release.
What Mobile Protect does[2][3][7][13]
Mobile Protect blocks hooking frameworks, debuggers and re-signed copies inside the app. Mobile Protect scores every session and flags likely fraud to your team. Mobile Protect includes SSL pinning built on TrustKit.
What Code SAST Secure does[3][5][8][14][16]
Code SAST Secure scans your code and dependencies. Code SAST Secure secures your code, open source libraries and vendor SBOMs in one place. Code SAST Secure catches infrastructure as code misconfigurations in the repository, before they ship.
What API Secure does[2][5][8][13][15]
API Secure scores every operation on its own across authentication. API Secure probes your APIs from outside, then signs in as two different users. API Secure spots the abuse and tells the WAF you already run what to block.
What Cloud Secure does[2][5][8][16]
Cloud Secure covers the resources, roles and data behind the APIs. Cloud Secure runs the same IaC checks on what is deployed, and secures the containers and registry images your APIs and apps run on.

What it sells: StackHawk

What Wingman does[15][16]
Wingman runs inside the coding agent that engineers already use. When the agent finishes a feature, Wingman tests the running app with HawkScan, hands the findings to the same agent, and rescans after the fix.
What StackHawk Scale does[15][16]
StackHawk Scale adds attack surface discovery and program reporting for security teams. StackHawk Scale is priced by team, not by usage.
What HawkScan does[3][15]
HawkScan tests the running application with real requests. StackHawk scans run as a CLI or Docker container that spins up and shuts down per scan. StackHawk scan configuration is YAML config-as-code, versioned alongside the app.

Questions about Data Theorem and StackHawk

What do Data Theorem and StackHawk sell?
Data Theorem sells Mobile Secure, Mobile Protect, Code SAST Secure, API Secure and Cloud Secure. StackHawk sells Wingman, StackHawk Scale and HawkScan.
Are Data Theorem and StackHawk in the same category?
They share API security. Data Theorem's primary category is API security and StackHawk's is Dynamic application security testing.
Where are Data Theorem and StackHawk headquartered?
Data Theorem is headquartered in Palo Alto, United States.
Who are Data Theorem and StackHawk sold to?
From its own pages, the company sells to teams that need to find every app, API and cloud resource, including the ones nobody told security about. Application security and product security teams that need coverage across every app and API are named as buyers, and the Scale plan is for security teams covering every app in the organization.
What have Data Theorem and StackHawk announced recently?
June 30, 2026: Data Theorem launched three AI security capabilities that together form a closed-loop platform covering exploit discovery, remediation, and runtime defense. April 30, 2026: StackHawk connected its scan findings to Wiz, where they are synced automatically and shown as enrichment data on the Attack Surface Findings page.

About Data Theorem

Data Theorem sells application security products that secure code, mobile apps, APIs and cloud. Data Theorem describes itself as an application security company. Customers can start with one Data Theorem product and add the rest on the same portal.[2][3][8][11]

Since 2013, Data Theorem has focused on preventing AppSec data breaches across apps, APIs and the cloud behind them. Data Theorem's information security management system is certified to ISO/IEC 27001:2022 and independently audited every year.[11]

Mobile Secure provides automated security and privacy testing for every iOS and Android release. Mobile Secure signs in to your apps and tests every screen of every release. Mobile Protect defends the app on the device. Mobile Protect blocks hooking frameworks, debuggers and re-signed copies inside the app. Mobile Protect scores every session and flags likely fraud to your team. Mobile Protect detects the overlay and the automation, and blocks memory scraping. Mobile Protect includes SSL pinning built on TrustKit.[8][13]

Code SAST Secure covers SAST, SCA and SBOM across every repo, in more than 20 languages. Code SAST Secure scans your code and dependencies. Code SAST Secure secures your code, open source libraries and vendor SBOMs in one place. API Secure discovers every REST, GraphQL, gRPC, SOAP and serverless API. API Secure scores every operation on its own across authentication. API Secure probes your APIs from outside, then signs in as two different users. API Secure spots the abuse and tells the WAF you already run what to block.[3][8][13][14][15]

Cloud Secure extends API Secure into the cloud your APIs and apps run on. Cloud Secure covers the resources, roles and data behind the APIs. Cloud Secure runs the same IaC checks on what is deployed, and secures the containers and registry images your APIs and apps run on.[8][16]

AI Exploits find the chains attackers would use, AI Auto-Remediation hands the fix to your coding agent, and AI Active Protection blocks the attack until the fix ships. ARCANE, short for AI-analysis of Runtime Code Across Native Environments, thinks like an AI attacker. Audit-ready reports for SOC 2, ISO, PCI DSS, HIPAA, OWASP and more are built from the latest tests and scans.[3][4][8][9][16]

Data Theorem on the record

Sources

Data Theorem full record

  1. [1]Data theorem unveils code secure fully integrated ast product with sast sca and sbom management 302269428Data Theorem via PR Newswire · prnewswire.com · published October 8, 2024 · Tier A
  2. [2]datatheorem.comData Theorem · datatheorem.com · undated page, accessed September 27, 2026 · Tier A
  3. [3]Solutions | Data TheoremData Theorem · undated page, accessed October 24, 2026 · Tier A
  4. [4]DevSecOps: Security in Every Stage, From Code to Runtime | Data TheoremData Theorem · undated page, accessed October 24, 2026 · Tier A
  5. [5]Products | Data TheoremData Theorem · undated page, accessed October 24, 2026 · Tier A
  6. [6]Mobile SecureData Theorem · undated page, accessed October 24, 2026 · Tier A
  7. [7]Mobile ProtectData Theorem · undated page, accessed October 24, 2026 · Tier A
  8. [8]Data Theorem | AppSec | API Security | Cloud SecurityData Theorem · undated page, accessed October 24, 2026 · Tier A
  9. [9]ASPM: Application Security Posture Management | Data TheoremData Theorem · undated page, accessed October 24, 2026 · Tier A
  10. [10]Data Theorem Reviews 2026: Details, Pricing, & Features | G2G2 · undated page, accessed October 24, 2026 · Tier C
  11. [11]Regulatory Compliance | Audit-Ready Reports | Data TheoremData Theorem · undated page, accessed November 3, 2026 · Tier A
  12. [12]AI-Driven Application Security (AppSec) | Data TheoremData Theorem · undated page, accessed November 3, 2026 · Tier A
  13. [13]AI Runtime Protection for Apps and APIs | Data TheoremData Theorem · undated page, accessed November 3, 2026 · Tier A
  14. [14]Code SAST Secure: SAST, SCA, SBOM and AI Auto-RemediationData Theorem · undated page, accessed November 3, 2026 · Tier A
  15. [15]API Security Testing and Runtime Protection | API SecureData Theorem · undated page, accessed November 3, 2026 · Tier A
  16. [16]Cloud Security for APIs and Cloud-Native Apps | Cloud SecureData Theorem · undated page, accessed November 3, 2026 · Tier A
  17. [17]Data Theorem Launches the Industry’s First Closed-Loop AI Security PlatformData Theorem · published June 30, 2026 · Tier A

StackHawk full record

  1. [1]stackhawk.comStackHawk · stackhawk.com · undated page, accessed September 27, 2026 · Tier A
  2. [2]Stackhawk launches sensitive data identification to help security teams protect high risk apis 302476776StackHawk via PR Newswire · prnewswire.com · published June 12, 2025 · Tier A
  3. [3]AI Coding Agent Security Platform | StackHawk, Inc.StackHawk · undated page, accessed October 28, 2026 · Tier A
  4. [4]AI Coding Agent Security for Modern Security Teams | StackHawk, Inc.StackHawk · undated page, accessed October 28, 2026 · Tier A
  5. [5]API Security Testing Trusted by HealthTechStackHawk · undated page, accessed October 28, 2026 · Tier A
  6. [6]API Security that keeps pace with FinTech InnovationStackHawk · undated page, accessed October 28, 2026 · Tier A
  7. [7]Getting Started | Delivering Secure Applications, SimplifiedStackHawk · undated page, accessed October 28, 2026 · Tier A
  8. [8]OWASP Top 10 Solution Page with StackHawk InsightsStackHawk · undated page, accessed October 28, 2026 · Tier A
  9. [9]StackHawk: Your AppSec Intelligence PlatformStackHawk · undated page, accessed October 28, 2026 · Tier A
  10. [10]Secure Vibe Coding with StackHawkStackHawk · undated page, accessed October 28, 2026 · Tier A
  11. [11]Runtime Application Business Logic Testing for API-Driven AppsStackHawk · undated page, accessed October 28, 2026 · Tier A
  12. [12]StackHawk and Wiz: One Risk Picture Across the Application and Cloud LayerStackHawk · published April 30, 2026 · Tier A
  13. [13]StackHawk + Endor Labs: Correlating and Prioritizing SAST and DAST FindingsStackHawk · published November 20, 2025 · Tier A
  14. [14]Introducing Intelligent Business Logic Testing: Find Authorization Flaws Pre-ProductionStackHawk · published December 16, 2025 · Tier A
  15. [15]About StackHawk | Security Feedback for Coding AgentsStackHawk · undated page, accessed November 10, 2026 · Tier A
  16. [16]Pricing for StackHawk's AI Coding Agent Security PlatformStackHawk · undated page, accessed November 10, 2026 · Tier A
  17. [17]Modern DAST | StackHawk Dynamic Application Security TestingStackHawk · undated page, accessed November 10, 2026 · Tier A
  18. [18]The Developer-First Alternative to Bright SecurityStackHawk · undated page, accessed November 10, 2026 · Tier A

Spot a factual error? Request a correction.