StackHawk has introduced Wingman, an AI‑driven assistant that automatically patches discovered vulnerabilities as developers type code and then validates the fix before the change reaches the CI pipeline. The shift places security enforcement directly inside the coding loop, which is relevant for AI engineers, cloud/platform engineers, SREs, and security practitioners who need to keep pace with AI‑generated code and the growing volume of security tickets.
How Wingman Works
Wingman installs as a plug‑in for Claude Code, Cursor, GitHub Copilot, Codex, and Antigravity. When an AI coding agent completes a feature, Wingman spins up the live application, runs StackHawk’s existing application testing suite, and captures any vulnerability findings. Those findings are fed back to the coding agent, which applies an automated fix. Wingman then rescans the application to confirm that the remediation holds and reports the result to the continuous integration (CI) system. Each test is linked to the specific commit that triggered it, creating an attestation record for security teams.
Architectural and Operational Implications
Integrating Wingman adds a new component to the development toolchain that interacts with both the AI coding assistant and the CI pipeline. Practitioners must provision the Wingman runtime alongside their development environments and ensure that the live application can be started automatically for each commit. The service is priced at $10 per user per month and allows up to 50 scans per user per month across unlimited applications, which may affect budgeting and scan‑quota planning. Because the scans are performed on a running instance, resource allocation for temporary test environments becomes part of the operational footprint.
Security and Process Considerations
Wingman moves the security control point from a post‑commit gate to the moment code is authored, aligning with a shift‑left approach. This can reduce the backlog of vulnerability tickets that DevSecOps teams traditionally triage after a build. However, the automated nature of the fixes means teams should still monitor regression rates; the vendor reports a 98 % fix‑retention rate for early customers, but ongoing verification is advisable. The per‑commit attestation also provides a traceable record that can be useful for compliance audits, but organizations need to decide how much trust to place in AI‑generated patches versus manual review.
Related CloudNinjas coverage: security.
What This Means For Practitioners
Teams should start by mapping their current AI coding assistants to Wingman’s supported list and running a pilot on a low‑risk service. Evaluate the impact on CI pipeline latency, scan quota consumption, and the accuracy of automated fixes. Establish a monitoring process for any regressions that appear after the AI‑applied patch, and incorporate the attestation data into existing compliance dashboards. Finally, weigh the $10‑per‑user cost against the projected reduction in manual remediation effort to determine ROI.
