StackHawk Leads the Way in Shift-Left API Security

API security has become a critical component in today’s digital-first world, where the pace of innovation is rapid, and vulnerabilities have significant consequences. To gain deeper insights into this field, we had the pleasure of sitting down with Joni Klippert, CEO of StackHawk, to discuss the state of API security, the challenges organizations face, and her vision for the future. We explore Joni’s journey in tech, her vision for API security, and how her company addresses some of the most pressing challenges in modern software development. From automating vulnerability testing to leveraging AI for API discovery, Joni offers a glimpse into the future of secure application development.

Watch&Listen to the full interview here.

Joni Klippert

CEO&Co-Founder at StackHawk

Joni, let’s start at the core—what does StackHawk do, and who is your platform designed for?

At its heart, StackHawk is a shift-left API security platform. When we founded the company in 2019, our focus was clear: make API security testing not only possible but seamless and automated. Traditionally, organizations relied on pen testing for application security, which meant someone would test your running application, generate a report, and hand it over. The problem? That report became outdated almost instantly, as code changes happen rapidly.

Our initial product addressed this with Dynamic Application Security Testing (DAST). But unlike traditional tools, our solution is designed for developers. We integrate directly into CI/CD pipelines, giving developers real-time feedback on vulnerabilities as they write code. This reduces the cost and disruption of fixing issues compared to discovering them months later in production.

It seems like you’ve transformed legacy DAST for today’s development workflows. How did your product evolve to tackle broader challenges in API security?

Great question. As we scaled, we realized that beyond testing, many organizations didn’t even know where all their APIs and applications were. This gap posed a significant risk. So, we introduced API Discovery, which uses AI to map an organization’s APIs by analyzing their source code.

Instead of relying solely on production traffic to identify APIs—a method that often overlooks unused but critical APIs—we take the source code as the ultimate truth. This approach allows us to identify APIs hidden in repositories, including those connecting to third-party SaaS products or handling sensitive data. The process is lightning-fast, analyzing a thousand repositories in about 15 minutes.

What makes API Discovery so impactful for organizations?

The sheer scale and complexity of today’s software environments make manual API mapping impractical. For instance, I’ve spoken to security professionals who spent a year embedded in engineering teams, manually cataloging repositories. Our solution automates this daunting task, delivering results quickly and accurately.

It’s all about bridging the gap between developers and security teams. By providing visibility into what needs testing, we help organizations secure their APIs at the speed of modern software delivery.

How do you encourage developers to embrace this responsibility, especially when they’re already juggling so much?

It’s true—developers carry a heavy load. Beyond writing code, they manage infrastructure, write automated tests, and even handle on-call duties for their own services. Adding security to the mix can feel overwhelming. But when security tools integrate seamlessly into their workflows, it becomes a manageable task rather than an extra burden.

Good security tools prioritize actionable insights over noise. Instead of overwhelming developers with a laundry list of issues, we highlight the most critical vulnerabilities, provide clear guidance to fix them, and integrate these insights directly into the developer’s environment.

API security has a long way to go, but the market is evolving. We’re early in solving these challenges, and there’s an incredible opportunity to educate, innovate, and improve how we secure our software.

That integration sounds critical. Can you tell us more about how StackHawk makes it easy for developers to incorporate security into their CI/CD pipelines?

StackHawk is designed with developers in mind. Configuration is simple—via a YAML file—and it runs using Docker or CLI, both familiar tools for engineers. In the CI/CD pipeline, it integrates as a GitHub Action, CircleCI orb, or with any preferred tool.

We encourage teams to test small pieces of code, like a single microservice, rather than the entire application. This approach is faster, often taking just a few minutes. Alerts are delivered where developers work, such as in pull request comments, and we can even block builds if high-severity vulnerabilities are found.

Another key feature is contextual messaging. We rewrote vulnerability definitions in plain engineering language, explaining why the issue matters, how it breaks the framework, and offering tips to fix it. Plus, we provide tools like curl commands for easy reproduction and debugging, and integrations with static analysis tools to pinpoint problematic lines of code.

It’s clear your focus on the developer experience is a game-changer. Would you say StackHawk’s core pillars are discoverability, testing, and oversight before production?

Exactly. Our goal is to make API security intuitive and proactive. Discover the attack surface, test thoroughly during development, and ensure no vulnerabilities make it to production. That’s how we empower developers to build secure applications confidently.

Joni, it was a pleasure speaking with you as your insights underscore the importance of staying proactive and collaborative in the evolving landscape of API security.