CISO Tribune

Vendor comparison · 2 companies

StackHawk vs Veracode

StackHawk sells two plans, Wingman and StackHawk Scale, that run on HawkScan, a runtime testing engine for running applications. Veracode sells an Application Risk Management Platform that identifies risks across the software development lifecycle, automates flaw fixes, and simplifies governance and compliance. CISO Tribune files both under Dynamic application security testing. This page sets the two records side by side: what each sells, where it is based, who owns and funds it, the customers it names and its recent news, each fact numbered to its source.

Change the companies

Up to four companies side by side.

  • StackHawk
  • Veracode
StackHawk vs Veracode: Products, Customers and Funding Compared
StackHawkStackHawk sells two plans, Wingman and StackHawk Scale, that run on HawkScan, a runtime testing engine for running applications.stackhawk.comVeracodeVeracode sells an Application Risk Management Platform that identifies risks across the software development lifecycle, automates flaw fixes, and simplifies governance and compliance.veracode.com
What it sells
  • Wingman[15][16]Runs inside a coding agent and tests the running app.
  • StackHawk Scale[15][16]The plan for security teams covering every app in the organization.
  • HawkScan[3][15]The runtime testing engine that tests the running application with real requests.
  • Veracode Dynamic Analysis[13]Dynamic scanning for runtime vulnerabilities in web apps and APIs.
  • Veracode Fix[15]AI-powered remediation for in-house code and open-source libraries.
  • eLearning[4][11]Hands-on training to build secure coding skills.
Categories
Headquarters
Not stated on its pagesNot stated on its pages
Founded
Not stated on its pagesNot stated on its pages
Ownership and funding
Not stated on its pagesOwned by Thoma Bravo since 2019[2][4][10][14]
Named customers
Not stated on its pagesNot stated on its pages
Recent news
  • April 30, 2026StackHawk connected its scan findings to Wiz, where they are synced automatically and shown as enrichment data on the Attack Surface Findings page.[12]
  • December 16, 2025StackHawk launched Business Logic Testing, automated multi-user authorization testing aimed at BOLA, BFLA and privilege escalation vulnerabilities.[14]
  • November 20, 2025StackHawk announced an integration that correlates findings from Endor Labs' SAST with StackHawk DAST findings.[13]
  • February 5, 2026Veracode announced that its new Annual Contract Value rose 81 percent year over year in the final quarter of 2025.[9]
G2 and Gartner Peer Insights
  • G2: Not stated on its pages
  • Gartner Peer Insights: Not stated on its pages
  • G2: listed, seen November 4, 2026[10]
  • Gartner Peer Insights: Not stated on its pages
Who it fits
Application security and product security teams that need coverage across every app and API are named as buyers, and the Scale plan is for security teams covering every app in the organization. The industries named are financial services, health tech, insurance, media, transportation, education technology, and cloud analytics. Scans are described as fitting into any pipeline and any environment, with no vendor cloud.The company says its platform gives enterprises a clearer view of application risk from code to runtime. The company addresses financial institutions on GLBA compliance. The company addresses healthcare regulations like HIPAA and GDPR. The company addresses developers who want remediation guidance and AI-driven fixes inside the tools they already use.
Last verified
November 2, 2026September 27, 2026

Where they overlap

  • StackHawk and Veracode are both filed under Dynamic application security testing.

Where they differ, field by field

  • StackHawk's primary category is Dynamic application security testing; Veracode's is Static application security testing.
  • StackHawk is also filed under API security. Veracode is also filed under Software composition analysis and Software supply chain security.
  • StackHawk lists Wingman, StackHawk Scale and HawkScan. Veracode lists Veracode Dynamic Analysis, Veracode Fix and eLearning.
  • Veracode is owned by Thoma Bravo, since 2019.

What it sells: StackHawk

What Wingman does[15][16]
Wingman runs inside the coding agent that engineers already use. When the agent finishes a feature, Wingman tests the running app with HawkScan, hands the findings to the same agent, and rescans after the fix.
What StackHawk Scale does[15][16]
StackHawk Scale adds attack surface discovery and program reporting for security teams. StackHawk Scale is priced by team, not by usage.
What HawkScan does[3][15]
HawkScan tests the running application with real requests. StackHawk scans run as a CLI or Docker container that spins up and shuts down per scan. StackHawk scan configuration is YAML config-as-code, versioned alongside the app.

What it sells: Veracode

What Veracode Dynamic Analysis does[13]
Dynamic application security testing identifies and addresses runtime vulnerabilities in web apps and APIs through simulated attacks. Dynamic scans can be automated or scheduled to match release frequency, compliance, and policy needs. Dynamic scans can cover hundreds of assets across environments, including those behind a firewall.
What Veracode Fix does[15]
Veracode Fix brings AI-powered remediation to the code written in-house and the open-source libraries it depends on. Veracode Fix integrates into the IDE, CLI, or CI/CD tool, with interactive and batch modes.

Questions about StackHawk and Veracode

What do StackHawk and Veracode sell?
StackHawk sells Wingman, StackHawk Scale and HawkScan. Veracode sells Veracode Dynamic Analysis, Veracode Fix and eLearning.
Are StackHawk and Veracode in the same category?
They share Dynamic application security testing. StackHawk's primary category is Dynamic application security testing and Veracode's is Static application security testing.
Who owns StackHawk and Veracode?
Veracode is owned by Thoma Bravo, since 2019.
Who are StackHawk and Veracode sold to?
Application security and product security teams that need coverage across every app and API are named as buyers, and the Scale plan is for security teams covering every app in the organization. The company says its platform gives enterprises a clearer view of application risk from code to runtime.
What have StackHawk and Veracode announced recently?
April 30, 2026: StackHawk connected its scan findings to Wiz, where they are synced automatically and shown as enrichment data on the Attack Surface Findings page. February 5, 2026: Veracode announced that its new Annual Contract Value rose 81 percent year over year in the final quarter of 2025.

About StackHawk

StackHawk sells two plans, Wingman and StackHawk Scale, that run on HawkScan, a runtime testing engine for running applications. StackHawk calls itself the security feedback layer for coding agents. StackHawk integrates into the agent loop to test the running app. The same AI coding agent that builds a feature calls StackHawk to scan the app, fix issues, and verify them before a push. StackHawk was founded in 2019 by Joni Klippert and Scott Gerlach. StackHawk is headquartered in Denver, Colorado. In July 2019 the StackHawk founding team came together to fix a problem: application security testing ran quarterly while software shipped daily.[1][3]

Wingman runs inside the coding agent that engineers already use, including Claude Code, Cursor, GitHub Copilot, Codex, and Antigravity. When the agent finishes a feature, Wingman tests the running app with HawkScan, hands the findings to the same agent, and rescans after the fix. Wingman auto-configures and boots the app, then tests it the way an attacker would. Wingman finds and fixes vulnerabilities in the same session, then rescans to verify the fix held. StackHawk provides a clean signal for CI and an attestation tied to each commit.[16]

StackHawk Scale is the plan for security teams covering every app in the organization. StackHawk Scale adds attack surface discovery and program reporting for security teams. StackHawk Scale is priced by team, not by usage, and unlimited apps and unlimited agentic scans are included.[16]

HawkScan tests the running application with real requests. StackHawk scans run as a CLI or Docker container that spins up and shuts down per scan. StackHawk scan configuration is YAML config-as-code, versioned alongside the app. StackHawk scans execute directly in GitHub Actions, GitLab, Jenkins, and CircleCI. StackHawk runs scans with no vendor cloud and no traffic traversing the internet to reach the apps. StackHawk supports incremental testing on code changes rather than full-app rescans. StackHawk delivers results in PR comments, Slack, Jira, and Datadog.[7][17]

StackHawk tests REST, GraphQL, SOAP, and gRPC APIs with real requests, auth flows, and attack scenarios. StackHawk tests LLM interfaces for prompt injection, data leakage, and unvalidated model outputs at runtime. StackHawk coverage runs from SQL injection, cross-site scripting, and remote code execution to sensitive data exposure, broken access control, and LLM risks such as prompt injection.[8][17]

The StackHawk platform extends the DAST testing engine with visibility from code and oversight across an AppSec program. Once a source code management system is integrated, StackHawk maps every API and app component from the code, including shadow APIs and AI/LLM interfaces. StackHawk uses risk insights from code to focus testing on the repositories and applications that carry the most exposure. StackHawk has native connections to GitHub, GitLab, Jira, Slack, Datadog, and SIEM and ticketing tools. StackHawk has native integrations with Jira, ServiceNow, Slack, and Microsoft Teams.[2][5][9][17][18]

With the HawkScan skill, the agent runs security tests against the running app, and vulnerabilities are identified, remediated, and verified post-commit and pre-PR. StackHawk agent skills install into Cursor via .cursor/rules/. StackHawk agent skills ship as a Codex plugin, and after install Codex can configure scans, test the local app, and remediate findings. Copilot discovers StackHawk skills from a repository.[1][3]

StackHawk names engineering teams shipping with AI coding agents among the teams that use it. StackHawk serves regulated and high-volume industries: financial services, health tech, insurance, media, transportation, education technology, and cloud analytics. StackHawk has SOC 2 Type II certification and role-based access control. StackHawk reached general availability in September 2020. StackHawk raised a $10 million Series A led by Sapphire Ventures in October 2020 and a $20.7 million Series B co-led by Sapphire and Costanoa Ventures in May 2022. In September 2026 StackHawk launched Wingman, which moves the find, fix, and verify loop inside the coding agent.[3][4][5][6][7][8][9][11][16][17][18]

StackHawk on the record

Sources

StackHawk full record

  1. [1]stackhawk.comStackHawk · stackhawk.com · undated page, accessed September 27, 2026 · Tier A
  2. [2]Stackhawk launches sensitive data identification to help security teams protect high risk apis 302476776StackHawk via PR Newswire · prnewswire.com · published June 12, 2025 · Tier A
  3. [3]AI Coding Agent Security Platform | StackHawk, Inc.StackHawk · undated page, accessed October 28, 2026 · Tier A
  4. [4]AI Coding Agent Security for Modern Security Teams | StackHawk, Inc.StackHawk · undated page, accessed October 28, 2026 · Tier A
  5. [5]API Security Testing Trusted by HealthTechStackHawk · undated page, accessed October 28, 2026 · Tier A
  6. [6]API Security that keeps pace with FinTech InnovationStackHawk · undated page, accessed October 28, 2026 · Tier A
  7. [7]Getting Started | Delivering Secure Applications, SimplifiedStackHawk · undated page, accessed October 28, 2026 · Tier A
  8. [8]OWASP Top 10 Solution Page with StackHawk InsightsStackHawk · undated page, accessed October 28, 2026 · Tier A
  9. [9]StackHawk: Your AppSec Intelligence PlatformStackHawk · undated page, accessed October 28, 2026 · Tier A
  10. [10]Secure Vibe Coding with StackHawkStackHawk · undated page, accessed October 28, 2026 · Tier A
  11. [11]Runtime Application Business Logic Testing for API-Driven AppsStackHawk · undated page, accessed October 28, 2026 · Tier A
  12. [12]StackHawk and Wiz: One Risk Picture Across the Application and Cloud LayerStackHawk · published April 30, 2026 · Tier A
  13. [13]StackHawk + Endor Labs: Correlating and Prioritizing SAST and DAST FindingsStackHawk · published November 20, 2025 · Tier A
  14. [14]Introducing Intelligent Business Logic Testing: Find Authorization Flaws Pre-ProductionStackHawk · published December 16, 2025 · Tier A
  15. [15]About StackHawk | Security Feedback for Coding AgentsStackHawk · undated page, accessed November 10, 2026 · Tier A
  16. [16]Pricing for StackHawk's AI Coding Agent Security PlatformStackHawk · undated page, accessed November 10, 2026 · Tier A
  17. [17]Modern DAST | StackHawk Dynamic Application Security TestingStackHawk · undated page, accessed November 10, 2026 · Tier A
  18. [18]The Developer-First Alternative to Bright SecurityStackHawk · undated page, accessed November 10, 2026 · Tier A

Veracode full record

  1. [1]PlatformVeracode · veracode.com · undated page, accessed September 27, 2026 · Tier A
  2. [2]Thoma bravo completes acquisition of veracode softwareThoma Bravo · thomabravo.com · published January 2, 2019 · Tier A
  3. [3]Veracode | Application Risk Management PlatformVeracode · undated page, accessed October 30, 2026 · Tier A
  4. [4]Application Risk Management: Secure Your SoftwareVeracode · undated page, accessed October 30, 2026 · Tier A
  5. [5]Static Application Security Testing (SAST) with VeracodeVeracode · undated page, accessed October 30, 2026 · Tier A
  6. [6]Code Confidently with Veracode Package FirewallVeracode · undated page, accessed October 30, 2026 · Tier A
  7. [7]Container Security | VeracodeVeracode · undated page, accessed October 30, 2026 · Tier A
  8. [8]Scan containers, IaC, and secrets | Veracode DocsVeracode Docs · undated page, accessed October 30, 2026 · Tier A
  9. [9]Veracode Closes Record Year of Growth and Innovation Amid Surging Demand for Application Risk ManagementBusiness Wire · published February 5, 2026 · Tier A
  10. [10]Veracode Application Security Platform Reviews & Product DetailsG2 · undated page, accessed October 30, 2026 · Tier C
  11. [11]Veracode | Application Risk Management SolutionsVeracode · undated page, accessed November 4, 2026 · Tier A
  12. [12]Chief Risk Officer (CRO) | Application Risk Management | VeracodeVeracode · undated page, accessed November 4, 2026 · Tier A
  13. [13]Dynamic Application Security Testing (DAST) with VeracodeVeracode · undated page, accessed November 4, 2026 · Tier A
  14. [14]Application Security for Healthcare | VeracodeVeracode · undated page, accessed November 4, 2026 · Tier A
  15. [15]AI Code Remediation | Fix Application Vulnerabilities with VeracodeVeracode · undated page, accessed November 4, 2026 · Tier A
  16. [16]Application Security for the Energy Sector | VeracodeVeracode · undated page, accessed November 4, 2026 · Tier A
  17. [17]GLBA Financial Security Compliance | VeracodeVeracode · undated page, accessed November 4, 2026 · Tier A

Spot a factual error? Request a correction.