Watching Engineers work in coding loops with StackHawk Wingman has been fascinating. Actually fixing vulnerabilities in code still always make my eyes get big 🤩 One of the most interesting things we've learned is around the AI maturity level of the engineering orgs and some common patterns. First post is about choosing the right model/tier for your work. We've seen people get frustrated and basically go backwards when they choose cheaper models. I wrote a blog post about it here. stackhawk.com/blog/cheap-ai-… CTOs and VPs of Eng: How are you teaching/encouraging model selections in your org?

I was looking at CVE trends the other day and something interesting popped out. Our ability to FIX needs to scale quickly and there's real urgency around that need. Big thanks to @JGamblin for double checking some of my CVE math. stackhawk.com/agentic-ai-sec…

Paying engineers $300 for 90 minutes of honest feedback. We built a security tool that runs inside your coding agent, tests your running app, and hands findings back to the agent to fix. I want people who use these tools daily to tell me what works, what doesn't, and what's missing.

GitHub just announced a new view for PRs. That's cool, but the underlying problem is getting worse and new filters don't fix it. stackhawk.com/blog/security-…

Claude's /run-skill-generator and /run are underused. They save real tokens. Your agent doesn't know how to build and launch your app, so it works it out from the repo. Every session. You pay for that every time. /run-skill-generator does the discovery ONCE. Build, launch, how to drive the app. Writes it to a per-project skill. After that /run reads the skill and goes. Ran it on a Spring Boot app today. Got a curl smoke script that builds, launches, hits the endpoints, clean exit. Plus the non-obvious stuff written down. Self-signed cert, port conflicts, a Gradle warning that looks like a failure and isn't. The win is simple. The agent stops rediscovering how to run your app every session. Lean CLAUDE.md too, since the run mechanics live in the skill instead of the context you pay for every turn. Write the run steps down once. Stop paying for the rediscovery.

Claude Code is fast at writing code to solve problems. It is not definitely secure. Different problems.

At @StackHawk , we've redefined API discovery with our latest release, API Discovery powered by HawkAI (hawk-eye). Read more about how we're helping customers uncover their entire api attack surface in my latest blog post. stackhawk.com/blog/re-defini…

Busy tomorrow at 10 AM PT? Why not join @JamesBerthoty and myself for tips and tricks on HOW to Shift-Left. Sign up here stackhawk.zoom.us/webinar/re… We're going to have a good time and hopefully you will as well :)