Application security company StackHawk Inc. today launched Wingman, a tool that fixes security vulnerabilities inside the artificial intelligence coding session that produced the flawed code.
The software installs into agentic coding workflows, among them Claude Code, Cursor and GitHub Copilot.
Wingman fires when a coding agent marks a feature as done. The scanner configures itself, boots the running application and probes it the way an attacker would, without a manual setup step. Findings then go back to the agent that wrote the code, which patches the flaw, and a second scan checks the repair before a pull request opens.
StackHawk’s argument is that an agent that built an application already holds its architecture, its dependencies and the conventions the rest of the team codes to. StackHawk said that context is what separates Wingman from a scanner bolted on downstream. Patches come back in the shape of the surrounding code.
Codex and Antigravity are supported too. Wingman tells the continuous integration pipeline whether a commit is clean. Because every test carries the commit it ran against, security teams end up with a record of what shipped.
StackHawk said Wingman fixed more than 7,000 vulnerabilities for early-access customers before the launch, and that 98% of those repairs have held. Attackers often reach a vulnerability before it is publicly disclosed, Chief Executive Joni Klippert said. AI coding agents have pushed engineering teams out ahead of what security can absorb.
“Finding was never the hard part,” Klippert said. “Fixing and verifying [a vulnerability] fast enough to match how engineering teams ship today, at machine speed, inside the workflow, as the code is written, is what security teams have never had the staff or the hours to do.”
Wingman costs $10 per user each month and includes unlimited applications with 50 scans per user a month. A 14-day free trial is available. Teams that need broader application programming interface discovery and attack-surface mapping can pair the tool with StackHawk Scale, the company’s enterprise tier.
StackHawk sells to more than 200 enterprises. The company is venture capital-backed and raised $20.7 million in May 2022 in a round led by Sapphire Ventures and Costanoa Ventures.
Klippert spoke with theCUBE, SiliconANGLE Media’s livestreaming studio, in March, when she discussed how developers should not have to become security specialists to ship safe code. “They want to write quality code, but they don’t want to become security engineers,” she said.
