Safeguard DAST vs StackHawk HawkScan
Safeguard DAST
safeguard.shStackHawk HawkScan
stackhawk.comSide by side
| Figure | Safeguard DAST | StackHawk HawkScan |
|---|---|---|
| Price from | — | $10/mo |
| Free plan | — | — |
| Free trial | — | Yes |
| Open source | — | — |
| Web | Yes | Yes |
| Windows | — | Yes |
| macOS | — | Yes |
| Linux | — | Yes |
| API | — | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 0 | 2 |
| Spec score · Dynamic Application Security Testing Software | 7.1 (#17) | 7.9 (#9) |
| Integrations | The listed CI integrations are GitHub Actions, GitLab CI, Buildkite, CircleCI and Jenkins. | The documentation lists CI/CD integrations including GitHub Actions, GitLab CI/CD, Azure Pipelines, Jenkins, CircleCI, and Bitbucket Pipelines, plus workflow integrations such as Slack, Jira Cloud, Microsoft Teams, and GitHub CodeQL. |
| Vulnerability coverage | The product states coverage for the OWASP Top 10 and API Top 10. | Wingman lists examples from more than 150 vulnerability types, including SQL injection, sensitive data exposure, cross-site scripting, and remote code execution. |
Plans
StackHawk HawkScan
- Wingman by StackHawk$10 a month
- StackHawk ScalePriced on request
In their own words
Safeguard DAST
Safeguard DAST dynamically tests running applications, reporting findings alongside how much discovered attack surface the scan reached. Its graph-aware crawler uses Safeguard SAST call graphs, route tables, and authentication middleware. Endpoint inventories can come from OpenAPI, GraphQL introspection, gRPC reflection, and live traffic samples. Targeted payloads cover SQL, OS command, SSRF, XSS, and deserialization sink classes, with parameter shapes informing generation. Authenticated flows include form authentication, OAuth 2.0 refresh, JWT bearer, session cookies, SAML, and mutual TLS. Listed scan modes are Fast, Deep, Progressive, and Reconnaissance; Reconnaissance sends no probes. Coverage Score explains reached surface and stopping reasons, while stated coverage includes the OWASP Top 10 and API Top 10. JavaScript, JSON, and source maps are analyzed for exposed credentials, routes, endpoints, cloud references, personal data, configuration, and comments. Secret samples are redacted, ownership verification gates requests, and scope, rate, and budget limits constrain them. It supports self-hosted and web use, hybrid deployment, CI integrations, pull-request and IDE workflows, and listed infrastructure analyses. Pricing is freemium: Free plan; paid from $9/mo.
StackHawk HawkScan
StackHawk HawkScan has no write-up on Specifiction yet; its figures are above.