This training gets you started on your journey with agentic security testing using StackHawk. Instead of running scans by hand and triaging findings on your own, you point your AI coding agent at your running application and let it do the work. It configures the scan, runs StackHawk's dynamic testing against your app, interprets the results, and fixes what it finds, then rescans to confirm the fix. This step-by-step training lets you watch that find-fix-verify loop happen firsthand.
You can follow this training on your own at your own pace, or alongside a live session with the StackHawk team.
- How agentic dynamic testing works, and how it compares to doing it by hand
- Installing the
hawkCLI - Installing the StackHawk skills in your AI coding agent
- Pointing your agent at your own running application
- Running your first agentic scan
- The find-fix-verify loop, where your agent scans, fixes, and rescans
- Why the depth of your configuration drives the quality of your scan
Important
Complete Parts 1 and 2 before a live training session. The prerequisites below, plus installing the CLI (Part 1) and your agent's skills (Part 2), are setup to finish ahead of time. In a live session we jump straight into Part 3: Run the Lab so we can spend our time on the agentic loop itself. Following this on your own? Just work through the parts in order.
The following prerequisites are the same regardless of your operating system or which AI agent you use.
StackHawk Account Access
To participate in and complete this training, you will need access to your organization's StackHawk account with permission to create new applications and API keys, on an active Secure, Scale, or Wingman subscription.
If you already have access to a StackHawk account, please do not create an additional organization. Doing so will add extra steps to the training.
You can log in to your StackHawk account at app.stackhawk.com. If you don't have an account yet, you can start a StackHawk Wingman trial to get set up.
An AI Coding Agent
You will need one of the supported AI coding agents installed: Claude Code, Cursor, Codex, GitHub Copilot, or Antigravity. You will install the StackHawk skills into your agent in Part 2.
Your Application
You will scan your own application, so have one ready to point your agent at. You need:
- A running application in a development or test environment. Avoid scanning production, since dynamic testing sends real attack payloads.
- Its source code open in your AI agent's workspace, so the agent can both scan the app and fix what it finds.
If you don't have an app of your own on hand, a deliberately vulnerable test app is available to scan instead.
This training has three parts. Setup differs depending on your operating system and your AI agent, but the lab itself is the same for everyone. Complete the parts in order.
Choose the setup guide for your operating system.
Choose the setup guide for your AI coding agent.
Once you have run the loop, these guides help you get more out of StackHawk.
If you run into any issues getting the prerequisites set up, or have questions along the way, reach out to our support team at support@stackhawk.com. We're more than happy to help.
Looking for the original training on running HawkScan manually? It now lives in legacy-training/. It is kept for reference and is no longer maintained.