StackHawk

The StackHawk team achieves what seems impossible. When we started, the path wasn't clear, but StackHawk has given us visibility into security weaknesses in our microservices that we couldn't test with other quality gates.

The configurability and integration options are excellent, and the support team is very responsive, valuing feedback and incorporating it into updates. However, there are limitations: it can only scan internet-accessible surfaces, and on-premise use is limited. Also, there's no granular role-based access control, so there's a risk of accidental deletion of scans or results by less experienced users. Overall, it helps us streamline our secure development initiatives.

The SaaS management platform simplifies application management significantly, offering an intuitive workflow for triage and remediation that helps our team quickly identify, prioritize, and address security vulnerabilities. The container-first design of the scanners provides great flexibility and easy integration into our workflows. Given our specific requirements, this architecture lets us create custom scanning workflows with our own scaffolding, offering more configuration power than any other DAST scanner we've tried. This flexibility meets our current needs and sets us up well for future developer-centric processes. The customer success team has been exceptional, guiding us to use the product effectively. They keep us updated regularly and are quick to respond to our questions, feature requests, and bug reports. Their proactive support has been invaluable. On a personal note, I love StackHawk's bird-themed branding—it's creative and adds a fun touch, even in their internal libraries. The toughest part has been the code-heavy scripting for application authentication. Many scanners use passive proxy mechanisms to capture auth traffic, making it easy to start authenticated scanning quickly. StackHawk doesn't offer that, instead relying on a more powerful scripting engine. That may not suit everyone. We met our compliance needs with other tools, but StackHawk let us implement headless, authenticated DAST fully automated, eliminating manual scan execution. That was the main reason we chose StackHawk. With some creativity, we're now planning what we call the 'ultimate shift left' for DAST, giving developers direct, controlled access. This automation and distribution lets us scale our application security program beyond just the security team, achieving the coverage we need.

StackHawk is an efficient and developer-friendly security testing tool. One of its best features is the easy CI/CD integration, which makes it simple to add to existing workflows. The scan times are fast, so teams can spot and fix security issues without delaying deployments. It would be great if they could send scorecards and PDF reports via email, making it easier to share with higher management—especially highlighting security flaws and outdated software recommendations.

You can set up any type of authenticated scan using its YAML configuration. It can run internal scans since it only needs the binary. Customer support has been excellent—they're always responsive, and even their bot is helpful. The Snyk integration enhances deeper analysis. However, they could improve reporting and add more dashboard views to track vulnerability remediation progress. Policy customization could be better; the current method for applying scan policies is quite manual. This tool lets me automate the security testing of an application when it's deployed, instead of doing manual pentests each time.

The application onboarding and vendor support are solid. API file scanning works well, and the tool is easy to use and implement, with good DevSecOps CI/CD integration. The dashboard results and attack surface utilization are useful. However, to onboard each application, we have to involve each app's point of contact to write extra configuration files, which slows things down and requires knowledge transfer to each POC for their YAML config. So far, we've onboarded a few of our client applications to StackHawk and are seeing positive results, using them to strengthen security with our dev teams to fix vulnerabilities.

Our dev team found it straightforward to connect their codebases and apps (Python, BitBucket, Jenkins, Jira). One team member volunteered to go through the process and documented the steps so the rest could follow along. I'm not a coder—I'm on the security side. So my perspective on StackHawk focuses on the admin portal and reporting, which are both excellent. Inviting developers to the portal was easy, and the reports give me the info I need to share for compliance and security efforts. This tool does a few things for us: 1. It introduces a DAST function that automates vulnerability discovery, which we previously did manually—not ideal. 2. It helps us cultivate a DevSecOps culture, and we're pairing it with Snyk for comprehensive CI/CD analysis. 3. Both of these help us meet our GRC requirements, as code development is now a focus for several compliance and privacy regulations.

StackHawk carried out a thorough security assessment, uncovering issues like SQL injection, XSS, and security misconfigurations. The detailed reports gave us clear explanations of each vulnerability along with steps to fix them. Another great feature is its adaptability to different environments, making it suitable for both black-box and white-box testing. I think adding a guided learning path would be helpful for users to get the most out of the tool. While StackHawk is flexible and easy to use, a structured learning path would walk users through configuring scans, understanding results, and applying security best practices. StackHawk fills the need for a DAST scanner that supports ethical hacking, helps with early vulnerability detection, and promotes secure development practices. By automating security assessments, it lets cybersecurity experts and dev teams spot weaknesses in web applications before they're exploited. Its capabilities support proactive security testing, helping organizations embed security into their SDLC and follow a shift-left model. With StackHawk, teams can improve their security posture while meeting industry standards and compliance requirements.

We recently started working with StackHawk for dynamic security scanning, and it's been fantastic. The tool offers a variety of scanning methods that have proven helpful for our dev team. But the real standout has been the people at StackHawk and the support they provide—unlike most big software vendors who leave you on your own after the sale, they've been with us every step of the way. The onboarding experience was among the best I've encountered in my career; their experts were friendly and helped us get everything set up, explaining all the features and options, and they're always there when we need assistance. I genuinely appreciate the whole StackHawk team for strengthening our security program and being such a great partner. I have no complaints about StackHawk. We had been using tools from larger vendors, but they were becoming less effective and losing value as costs climbed. After exploring the crowded market and evaluating several options for code scanning and API scanning, we found StackHawk to be easy to set up and integrate. We also noticed that their staff and support were top-notch.

The detailed documentation from StackHawk is a huge plus, making it straightforward to hand off to developers so everyone shares the responsibility for writing scans. I'm impressed with the speed and flexibility of their scanning setup, which let me tweak the balance between cost and scan efficiency to fit our needs. This product really promotes a shift-left approach, catching issues earlier in the development cycle and cutting down on tech debt while boosting security. There are tons of features, and the team at StackHawk provides excellent support to ensure we get the most out of it. Before StackHawk, we struggled with slow scans from Tenable Nessus, but StackHawk has been a dramatic improvement, especially with its configuration-as-code rather than a traditional web UI. Plus, getting started was super fast and simple, and it integrated smoothly with our existing tools like GitHub CodeQL and Jira for managing findings. The only thing I'd like to see is more automation integration that ties results back to a specific release. I rely on StackHawk for DAST and API scans, giving us early penetration test results. This helps our team spot issues sooner, leading to less tech debt and stronger security. The quick, configurable scans and solid documentation make developer collaboration much easier.