That raises architecture questions the source only hints at. Runtime scanning during development is useful only if local or ephemeral environments mirror production-relevant authentication flows, APIs, feature flags and service dependencies closely enough to expose real issues. Teams will need to decide whether this fits best in developer workstations, cloud dev environments or preview environments, and how secrets, test data and network access are controlled while scans run automatically.
There is also an operational trade-off: moving security left can reduce ticket backlog, but it also shifts more responsibility for scan fidelity, false positives and remediation quality into platform engineering and AppSec enablement. Organizations should treat tools like this as part of an opinionated control loop, with guardrails around:
- which repos and frameworks are supported consistently,
- what level of autonomous code change is allowed before human review,
- how attestation data maps to audit and compliance evidence, and
- when unresolved findings still escalate to CI/CD gates or security review.
If implemented well, the real benefit is less about replacing AppSec review and more about preventing AI-assisted development from creating a remediation queue that grows faster than security teams can inspect it.
StackHawk this week launched Wingman, an artificial intelligence (AI) tool that makes it possible for application developers to automatically fix vulnerability issues as code is being written.
Wingman is designed to install into Claude Code, Cursor, GitHub Copilot, Codex, and Antigravity. It scans the live application, interprets findings, and fixes vulnerabilities in a way that makes it simpler for application developers to maintain context as they write code. At the core of those capabilities is StackHawk’s application testing platform, which Wingman accesses through a set of AI skills, hooks and rules.
Once an AI coding agent finishes a feature, Wingman auto-configures and boots the running application to run a series of security tests with no manual steps required. Findings are then shared with the AI coding agent that wrote the code to fix any issues discovered. Wingman then rescans that application to confirm the fix held before reporting back to the continuous integration (CI) pipeline that the issue has been resolved. Every test is tied to a specific commit, giving security teams an attestation record of what code was securely shipped.
Priced at $10 per user, per month, Wingman includes unlimited applications that can be scanned 50 times per user, per month. StackHawk claims Wingman has already automatically fixed more than 7,000 vulnerabilities for early access customers, with 98% of those fixes remaining resolved with no regressions.
StackHawk CEO Joni Klippert said Wingman is designed to prevent vulnerabilities from ever finding their way into a build in the first place. That capability dramatically reduces the backlog of issues that DevSecOps teams need to address by eliminating tickets they would otherwise have to address at a time when the overall pace at which code is being generated has dramatically accelerated in the AI era, she added.
Mitch Ashley, vice president and practice lead for the Futurum Group, said embedding the fix and verification inside the coding session moves the security control point out of the pipeline gate and into the loop that writes the code. That is the right response to AI-generated code because verification work is accumulating faster than teams can hire reviewers, he added.
Most application developers, to one degree or another, are now relying on AI to generate code. Historically, those application developers lacked the security expertise required to prevent vulnerabilities from being inadvertently included in their code. As the pace at which code is developed in the AI era continues to accelerate, the number of issues that DevSecOps teams are expected to resolve has already dramatically increased. The goal now needs to be to resolve those issues before any ticket is ever created.
Hopefully, the quality of the code being generated in the AI era will get better sooner than later. In the meantime, however, DevSecOps teams, in the absence of any ability to automatically remediate vulnerabilities, are increasing technical security debt at a time when cybercriminals are becoming more adept at using AI to reverse engineer the code needed to exploit those vulnerabilities.
StackHawk Delivers Wingman to Fix Vulnerabilities as Developers Write Code
Enjoyed this article? Sign up for our newsletter to receive regular insights and stay connected.