The rapid acceleration of software development driven by artificial intelligence has unlocked unprecedented levels of developer productivity, but it has simultaneously exacerbated a sprawling crisis in application security. As millions of developers routinely turn to AI coding assistants to generate complex routines, the volume of code moving from ideation to production has completely outpaced traditional human review cycles.
Into this breach steps StackHawk, which this week officially launched Wingman—an innovative AI-powered security tool engineered to automatically detect, fix, and verify security vulnerabilities in real-time during active, AI-assisted coding sessions.
Rather than treating application security as a downstream bottleneck or a rigid gatekeeper at the end of the continuous integration and continuous deployment (CI/CD) pipeline, Wingman embeds directly into the developer’s loop. By integrating seamlessly with market-leading AI coding agents such as Claude Code, Cursor, GitHub Copilot, Codex, and Antigravity, Wingman acts as a proactive security partner. It bridges a critical historical gap: equipping developers—many of whom lack deep security expertise—with automated guardrails to intercept, remediate, and verify security flaws before a single ticket can even be filed in a bug tracker.
Priced accessibly at $10 per user, per month, and boasting impressive early-access metrics—including over 7,000 automatically resolved vulnerabilities with a staggering 98% regression-free success rate—Wingman represents a paradigm shift. It moves the center of gravity for security controls from reactive pipeline policing to proactive, in-session remediation. This in-depth report explores the technological architecture of Wingman, the pressures driving its creation, expert industry analysis, and what this development signals for the future of DevSecOps.
Detailed Chronology & Technological Architecture
The Mechanics of In-Session Security
For decades, application security testing (AST) tools operated as audit mechanisms. They scanned codebases, compiled exhaustive lists of Common Weaknesses Enumerations (CWEs), and dumped hundreds—sometimes thousands—of tickets onto the laps of overburdened DevSecOps teams. In the AI era, this model has broken down entirely. AI assistants write code at a scale that quickly overwhelms manual remediation capabilities, resulting in an escalating mountain of technical security debt.
StackHawk designed Wingman to short-circuit this cycle by shifting security validation directly into the developer workspace. The chronological sequence of a typical Wingman intervention unfolds transparently within the developer’s environment:
Coding and Generation: A developer uses an AI coding assistant (e.g., Claude Code or Cursor) to draft a new feature, API endpoint, or database integration.
Feature Completion Trigger: Once the AI coding agent finishes drafting the feature, Wingman’s core orchestration layer—powered by a sophisticated suite of AI skills, hooks, and rules—automatically detects the completion event.
Automated Provisioning and Testing: Without requiring manual intervention from the developer, Wingman auto-configures and boots up the live, running application in a secure sandbox or local runtime environment. It immediately executes a targeted series of dynamic security tests leveraging StackHawk’s underlying testing platform.
Intelligent Feedback Loop: If vulnerabilities are identified, Wingman interprets the raw telemetry and findings. Instead of generating a generic ticket for a human security engineer, it directly feeds the structured findings back to the specific AI coding agent that generated the flawed code.
Remediation and Rescan: The AI coding agent ingests the error parameters and applies a code fix in real-time. Immediately following this patch, Wingman rescans the application to cryptographically and functionally confirm that the fix holds and that no new issues or regressions were introduced.
Pipeline Attestation and Audit Trail: Once verification succeeds, Wingman reports back to the CI pipeline that the issue has been thoroughly resolved. Crucially, every test and verification cycle is tethered directly to a specific Git commit. This provides security and compliance teams with an immutable attestation record of precisely what secure code was shipped.
Ecosystem Integration
Wingman was built not to add another standalone dashboard to the developer’s screen, but to inhabit the tools they already use daily. By embedding natively into Claude Code, Cursor, GitHub Copilot, Codex, and Antigravity, Wingman preserves developer context.
Developers no longer need to context-switch away from their Integrated Development Environments (IDEs) to parse security reports or interpret complex CVSS scores. The security loop closes entirely within the terminal or editor window where the code is born.
Supporting Context & Metrics
Economics and Performance at Scale
The financial and operational viability of security tools often hinges on pricing structures and verifiable performance metrics. StackHawk has positioned Wingman with a developer-first business model:
Pricing Model: $10 per user, per month.
Usage Limits: Includes an allowance for unlimited applications to be scanned up to 50 times per user, per month—striking a balance that accommodates heavy, iterative development cycles.
Early Access Validation: During its closed beta and early access phases, StackHawk tracked performance metrics across real-world enterprise environments. According to the company, Wingman successfully and autonomously remediated more than 7,000 vulnerabilities. Most importantly, 98% of those automated fixes remained fully resolved, displaying zero regressions when subjected to subsequent testing iterations.
The Macro Threat Landscape
To understand why a tool like Wingman is necessary right now, one must examine the broader cyber threat landscape.
Cybercriminals are increasingly weaponizing artificial intelligence. Malicious actors leverage automated scripts and AI models to rapidly reverse-engineer software artifacts, scan public repositories, and zero in on newly introduced vulnerabilities before security teams can patch them. When human developers generate code at lightning speed using AI—frequently inadvertently introducing common security anti-patterns like insecure direct object references (IDOR), SQL injection vectors, or broken authentication loops—they inadvertently supply attackers with an abundant supply of low-hanging fruit.
Without automated remediation tools like Wingman, the velocity of code creation guarantees that technical security debt will compound exponentially.
Official Statements & Industry Perspectives
Industry leaders have been quick to weigh in on the architectural significance of moving security controls directly into the AI coding session.
StackHawk Leadership: Eliminating the Backlog
StackHawk CEO Joni Klippert emphasized that the primary design philosophy behind Wingman is to intercept vulnerabilities before they ever materialize in an official build artifact.
"Wingman is designed to prevent vulnerabilities from ever finding their way into a build in the first place," Klippert noted.
"That capability dramatically reduces the backlog of issues that DevSecOps teams need to address by eliminating tickets they would otherwise have to handle at a time when the overall pace at which code is being generated has dramatically accelerated in the AI era."
By cutting off the supply of avoidable vulnerabilities at the source, DevSecOps personnel can pivot away from triage and focus on high-value threat intelligence, architecture review, and hardening core infrastructure.
Analyst Perspective: Shifting the Control Point
Mitch Ashley, Vice President and Practice Lead for the Futurum Group, highlighted the strategic importance of shifting security enforcement from traditional pipeline gates to the developer’s creative loop.
"Embedding the fix and verification inside the coding session moves the security control point out of the pipeline gate and into the loop that writes the code," said Ashley.
"That is the right response to AI-generated code because verification work is accumulating faster than teams can hire reviewers."
As human review bandwidth hits a hard biological and economic ceiling, automating the verification loop becomes an existential necessity for engineering organizations scaling up their AI adoption.
Future Outlook: The Next Phase of DevSecOps
The introduction of tools like StackHawk’s Wingman signals a fundamental maturation phase in the intersection of artificial intelligence and software engineering. We are moving rapidly past the "Wild West" phase of AI code generation—where sheer velocity trumped quality—and entering an era defined by automated accountability and intelligent self-healing systems.
What Lies Ahead for AppSec?
Autonomous Compliance and Attestation: As regulatory frameworks (such as the EU Cyber Resilience Act and expanding SEC cybersecurity disclosure rules) place tighter burdens on software bill of materials (SBOMs) and secure software development lifecycles (SSDLC), tools that provide automated commit-level security attestations will become standard procurement requirements.
Expansion of AI Agent Loop Capabilities: Future iterations of in-session remediation tools will likely expand beyond traditional dynamic application security testing (DAST) parameters. They will likely incorporate advanced threat-modeling capabilities, predicting how interconnected microservices might fail under load when modified by an AI assistant.
Cultural Normalization of "Zero-Ticket" Workflows: The ultimate destination for DevSecOps is a zero-ticket development lifecycle—a state where minor and moderate vulnerabilities are caught, debated, and fixed by AI pairings before code ever hits a pull request review.
Conclusion
StackHawk Wingman does not merely automate a security scan; it re-architects the relationship between development and security. By meeting developers inside their AI coding environments—whether they are using Claude Code, Cursor, or GitHub Copilot—and closing the loop with automated verification, StackHawk has provided a viable blueprint for securing the AI-generated software supply chain. For engineering leaders struggling to balance the unyielding demand for software velocity with the non-negotiable imperative of enterprise security, tools like Wingman offer a clear path forward: fix it before it ships, verify it automatically, and let developers code with confidence.
