CISO Tribune

Vendor comparison · 2 companies

Salt Security vs StackHawk

Salt Security provides security for the APIs, MCP servers and data infrastructure where agents execute. StackHawk sells two plans, Wingman and StackHawk Scale, that run on HawkScan, a runtime testing engine for running applications. CISO Tribune files both under API security. This page sets the two records side by side: what each sells, where it is based, who owns and funds it, the customers it names and its recent news, each fact numbered to its source.

Change the companies

Up to four companies side by side.

  • Salt Security
  • StackHawk
Salt Security vs StackHawk: Products, Customers and Funding Compared
Salt SecuritySalt Security provides security for the APIs, MCP servers and data infrastructure where agents execute.salt.securityStackHawkStackHawk sells two plans, Wingman and StackHawk Scale, that run on HawkScan, a runtime testing engine for running applications.stackhawk.com
What it sells
  • Agentic Security Graph[4][8]Maps and correlates the full environment out-of-band.
  • Salt Surface[5][9]Provides agentless, outside-in discovery of MCP servers and APIs.
  • Salt Connect[5][9]Provides cloud and code inventory.
  • Wingman[15][16]Runs inside a coding agent and tests the running app.
  • StackHawk Scale[15][16]The plan for security teams covering every app in the organization.
  • HawkScan[3][15]The runtime testing engine that tests the running application with real requests.
Categories
Headquarters
Palo Alto, United States[1][3]Not stated on its pages
Founded
2016[1][11]Not stated on its pages
Ownership and funding
Not stated on its pagesNot stated on its pages
Named customers
Not stated on its pagesNot stated on its pages
Recent news
  • June 1, 2026Salt Security launched Salt Code, a component that enforces security policies on AI-generated code across the development lifecycle.[17]
  • April 30, 2026StackHawk connected its scan findings to Wiz, where they are synced automatically and shown as enrichment data on the Attack Surface Findings page.[12]
  • December 16, 2025StackHawk launched Business Logic Testing, automated multi-user authorization testing aimed at BOLA, BFLA and privilege escalation vulnerabilities.[14]
  • November 20, 2025StackHawk announced an integration that correlates findings from Endor Labs' SAST with StackHawk DAST findings.[13]
G2 and Gartner Peer Insights
  • G2: listed, seen November 10, 2026[7]
  • Gartner Peer Insights: Not stated on its pages
  • G2: Not stated on its pages
  • Gartner Peer Insights: Not stated on its pages
Who it fits
From its own pages, the company shows an industry solution for Finance, described as stop fraud and abuse. It lists one for Healthcare, described as HIPPAA-grade protection. Transportation is also listed, with secure logistics APIs. Retail is listed, with protect PII at scale. Software is listed, with API-first app security. Its whitepaper page also says security teams face a challenge in which the action layer goes unmonitored.Application security and product security teams that need coverage across every app and API are named as buyers, and the Scale plan is for security teams covering every app in the organization. The industries named are financial services, health tech, insurance, media, transportation, education technology, and cloud analytics. Scans are described as fitting into any pipeline and any environment, with no vendor cloud.
Last verified
September 27, 2026November 2, 2026

Where they overlap

  • Salt Security and StackHawk are both filed under API security.

Where they differ, field by field

  • Salt Security's primary category is API security; StackHawk's is Dynamic application security testing.
  • Salt Security is also filed under AI model and agent security.
  • Salt Security lists Agentic Security Graph, Salt Surface and Salt Connect. StackHawk lists Wingman, StackHawk Scale and HawkScan.
  • Salt Security is headquartered in Palo Alto, United States.
  • Salt Security was founded in 2016.

What it sells: Salt Security

What Agentic Security Graph does[4][8]
Salt's Agentic Security Graph maps and correlates the full environment out-of-band. Salt describes its agentic security platform as one graph of agents, the MCP servers they use and the APIs they call, with the context behind each one.
What Salt Surface does[5][9]
Salt Surface provides agentless, outside-in discovery of MCP servers and APIs. Salt Surface discovers these from the outside, without an agent.
What Salt Connect does[5][9]
Salt Connect provides cloud and code inventory. Salt names Salt Connect together with collectors that are used where runtime analysis is needed.

What it sells: StackHawk

What Wingman does[15][16]
Wingman runs inside the coding agent that engineers already use. When the agent finishes a feature, Wingman tests the running app with HawkScan, hands the findings to the same agent, and rescans after the fix.
What StackHawk Scale does[15][16]
StackHawk Scale adds attack surface discovery and program reporting for security teams. StackHawk Scale is priced by team, not by usage.
What HawkScan does[3][15]
HawkScan tests the running application with real requests. StackHawk scans run as a CLI or Docker container that spins up and shuts down per scan. StackHawk scan configuration is YAML config-as-code, versioned alongside the app.

Questions about Salt Security and StackHawk

What do Salt Security and StackHawk sell?
Salt Security sells Agentic Security Graph, Salt Surface and Salt Connect. StackHawk sells Wingman, StackHawk Scale and HawkScan.
Are Salt Security and StackHawk in the same category?
They share API security. Salt Security's primary category is API security and StackHawk's is Dynamic application security testing.
Where are Salt Security and StackHawk headquartered?
Salt Security is headquartered in Palo Alto, United States.
When were Salt Security and StackHawk founded?
Salt Security was founded in 2016.
Who are Salt Security and StackHawk sold to?
From its own pages, the company shows an industry solution for Finance, described as stop fraud and abuse. Application security and product security teams that need coverage across every app and API are named as buyers, and the Scale plan is for security teams covering every app in the organization.
What have Salt Security and StackHawk announced recently?
June 1, 2026: Salt Security launched Salt Code, a component that enforces security policies on AI-generated code across the development lifecycle. April 30, 2026: StackHawk connected its scan findings to Wiz, where they are synced automatically and shown as enrichment data on the Attack Surface Findings page.

About Salt Security

Salt Security provides security for the APIs, MCP servers and data infrastructure where agents execute. Salt describes its agentic security platform as one graph of agents, the MCP servers they use and the APIs they call, with the context behind each one. Salt states that AI agents and MCPs run on APIs. Salt Security, Inc. is a Delaware corporation with its principal place of business in Palo Alto, California. Roey Eliyahu and Michael Nicosia founded Salt in 2018.[4][8][9][10][13]

Salt covers every agent, LLM, MCP server and API, with depth into the exposure, code, configuration and runtime behind each one. Salt's Agentic Security Graph maps and correlates the full environment out-of-band. Salt delivers protection without proxying all MCP traffic through an inline gateway. Salt maps agent posture to the EU AI Act, NIST and SOC 2.[6][8][12]

Salt Surface provides agentless, outside-in discovery of MCP servers and APIs. Salt Connect provides cloud and code inventory. Salt uses collectors where runtime analysis is needed. Salt Code scans repositories and pull requests for risky API integrations, shadow MCP servers and dangerous agentic patterns before they ship. Salt discovers every agent, MCP server and tool, including shadow MCPs. Salt flags exposed endpoints, hardcoded secrets and over-scoped access. Salt detects prompt injection and context manipulation, and Salt tells legitimate agents apart from malicious bots. Salt blocks machine-speed abuse in real time.[8][9][12][13]

Salt provides one living inventory, with owners, of everything agents can reach. Salt also offers a solution to stop fraud, abuse and agent hijacking that look like valid traffic.[13]

Salt generates up-to-date specs for APIs and feeds them into application security testing tools, including SAST, DAST and IasT. Salt continuously assesses security posture compliance in CI/CD pipelines and staging. Salt compares findings to OAS and Swagger files to show where documentation and live API traffic diverge. Salt sends Jira tickets and Slack notifications directly from the Salt platform.[14]

Salt describes its deployment as starting with agentless discovery, then adding protection through the gateways, WAFs and SOC tools a customer already runs. Salt lists 40+ technology integrations across cloud, gateways, edge, code and the SOC.

Salt provides DeinDeal with an updated inventory of all its APIs and exposed sensitive data. Armis uses the dynamic reporting in Salt for compliance audits and to demonstrate FedRAMP adherence. Salt helps Navan validate the pen testing activities of its internal testers and bug bounty program.[15]

Salt Labs research into agent, MCP and API threats informs the Salt platform. The H2 2026 State of AI and API Security report examines how companies are securing AI and APIs.[2][4][9][13][15][16]

Salt Security on the record

Sources

Salt Security full record

  1. [1]Salt security raises 140 million series d round led by capitalg at 1 4 billion valuationSalt Security · salt.security · undated page, accessed September 27, 2026 · Tier A
  2. [2]Salt security extends its agentic security platform with native ai detection and responseSalt Security · salt.security · published September 22, 2026 · Tier A
  3. [3]Contact usSalt Security · salt.security · undated page, accessed September 27, 2026 · Tier A
  4. [4]The Agentic Security Graph: A New Framework for the AI EraSalt Security · undated page, accessed October 28, 2026 · Tier A
  5. [5]Salt Security: Agentic AI Security, MCP Discovery, and API SecuritySalt Security · undated page, accessed October 28, 2026 · Tier A
  6. [6]EU AI Act Compliance 2026: What High-risk AI Systems Must Do Now | Salt SecuritySalt Security · undated page, accessed October 28, 2026 · Tier A
  7. [7]Salt Security Reviews & Product Details - G2G2 · undated page, accessed October 28, 2026 · Tier C
  8. [8]Onyx Security vs Salt Security | Secure the Agentic Action LayerSalt Security · undated page, accessed November 10, 2026 · Tier A
  9. [9]Securing APIs - API Attack Surface Management SolutionSalt Security · undated page, accessed November 10, 2026 · Tier A
  10. [10]Salt Security Master Services AgreementSalt Security · published May 20, 2026 · Tier A
  11. [11]API Security Company - About Us Salt Security API SecuritySalt Security · undated page, accessed November 10, 2026 · Tier A
  12. [12]Agentic Security Platform - Complete AI & API Protection PlatformSalt Security · undated page, accessed November 10, 2026 · Tier A
  13. [13]API Security Software - API Security Management SoftwareSalt Security · undated page, accessed November 10, 2026 · Tier A
  14. [14]Proactive API Security - “Shift Left" API DevelopmentSalt Security · undated page, accessed November 10, 2026 · Tier A
  15. [15]API Security Customers - Salt Security CustomersSalt Security · undated page, accessed November 10, 2026 · Tier A
  16. [16]API Security Trends - API Attacks, Breaches & Threats ReportSalt Security · undated page, accessed November 10, 2026 · Tier A
  17. [17]Salt Security launches Salt CodeSalt Security · published June 1, 2026 · Tier A

StackHawk full record

  1. [1]stackhawk.comStackHawk · stackhawk.com · undated page, accessed September 27, 2026 · Tier A
  2. [2]Stackhawk launches sensitive data identification to help security teams protect high risk apis 302476776StackHawk via PR Newswire · prnewswire.com · published June 12, 2025 · Tier A
  3. [3]AI Coding Agent Security Platform | StackHawk, Inc.StackHawk · undated page, accessed October 28, 2026 · Tier A
  4. [4]AI Coding Agent Security for Modern Security Teams | StackHawk, Inc.StackHawk · undated page, accessed October 28, 2026 · Tier A
  5. [5]API Security Testing Trusted by HealthTechStackHawk · undated page, accessed October 28, 2026 · Tier A
  6. [6]API Security that keeps pace with FinTech InnovationStackHawk · undated page, accessed October 28, 2026 · Tier A
  7. [7]Getting Started | Delivering Secure Applications, SimplifiedStackHawk · undated page, accessed October 28, 2026 · Tier A
  8. [8]OWASP Top 10 Solution Page with StackHawk InsightsStackHawk · undated page, accessed October 28, 2026 · Tier A
  9. [9]StackHawk: Your AppSec Intelligence PlatformStackHawk · undated page, accessed October 28, 2026 · Tier A
  10. [10]Secure Vibe Coding with StackHawkStackHawk · undated page, accessed October 28, 2026 · Tier A
  11. [11]Runtime Application Business Logic Testing for API-Driven AppsStackHawk · undated page, accessed October 28, 2026 · Tier A
  12. [12]StackHawk and Wiz: One Risk Picture Across the Application and Cloud LayerStackHawk · published April 30, 2026 · Tier A
  13. [13]StackHawk + Endor Labs: Correlating and Prioritizing SAST and DAST FindingsStackHawk · published November 20, 2025 · Tier A
  14. [14]Introducing Intelligent Business Logic Testing: Find Authorization Flaws Pre-ProductionStackHawk · published December 16, 2025 · Tier A
  15. [15]About StackHawk | Security Feedback for Coding AgentsStackHawk · undated page, accessed November 10, 2026 · Tier A
  16. [16]Pricing for StackHawk's AI Coding Agent Security PlatformStackHawk · undated page, accessed November 10, 2026 · Tier A
  17. [17]Modern DAST | StackHawk Dynamic Application Security TestingStackHawk · undated page, accessed November 10, 2026 · Tier A
  18. [18]The Developer-First Alternative to Bright SecurityStackHawk · undated page, accessed November 10, 2026 · Tier A

Spot a factual error? Request a correction.