StackHawk pricing
What middleBrick covers
- Map findings to PCI-DSS 4.0, SOC 2 Type II, and OWASP API Top 10
- Supports authenticated scans with Bearer, API key, Basic, and Cookie
- URL-based black-box scanning with under one minute runtime
- Detects OWASP API Top 10 categories including LLM security probes
- Provides dashboard, trend tracking, and downloadable compliance PDFs
- Integrates via CLI, GitHub Action, MCP Server, and webhooks
StackHawk pricing transparency
StackHawk does not publish a per-seat or per-scan price list on its public pages. The cost for a deployment is driven by the number of unique APIs, the scan schedule you choose, authentication complexity, and whether you require continuous monitoring or compliance artifacts. To obtain a quote you typically need to engage sales so the vendor can scope the deployment and map your environment to the appropriate tier.
What drives StackHawk costs
Several factors influence the final quote. The number of distinct API endpoints and the presence of many microservices increase the base cost. Frequent scanning or continuous monitoring adds to the price because of recurring compute and diff analysis. Authentication mechanisms such as Bearer tokens, API keys, or Basic auth require domain verification and add configuration overhead. Compliance needs such as scheduled reports, signed webhooks, and extended audit trails also affect the total cost of ownership.
Feature set by subscription tier
Higher tiers provide a broader feature set rather than simply increasing scan volume. Starter tiers typically include dashboard access, email alerts, and basic integrations such as an npm CLI and a GitHub Action. Pro tiers add continuous monitoring, scheduled rescans, and integration with CI/CD pipelines with quality gates. Enterprise tiers usually include custom rules, SSO, detailed audit logs, SLAs, and dedicated support to manage large-scale deployments.
Compliance mapping and scanning scope
The scanner maps findings to established security frameworks such as PCI-DSS 4.0, SOC 2 Type II, and OWASP API Top 10 (2023). It helps you prepare for audits by surfacing findings relevant to controls in these frameworks, but it does not perform certification. The tool supports authenticated scans with header allowlists and domain verification to ensure that credentials are used only by authorized owners. Note that the tool does not perform active injection tests or replace a human pentester for high-stakes assessments.
Deployment and operational considerations
Operational costs are influenced by how the scanner is used in your workflow. Running ad hoc scans from the CLI is typically included in lower tiers, while automated scheduled scans and webhook integrations may require higher tiers. Integration with issue trackers and ticketing systems can reduce manual work but may introduce additional licensing or configuration costs. Teams should estimate the number of APIs and the desired scan cadence when budgeting.